Actually they check the $_GET['id'] variable, which is used to set the $UserId variable. Check the top of the source:

if (empty($_GET['id']) || !is_numeric($_GET['id']) || (!empty($_GET['preview']) && !is_numeric($_GET['preview']))) {