Ask what their traffic source is. Even if they are using consoles - where MSIE will send a blank referer - you should still get a few 'leaks' here and there from other browsers that will show the URL that generated the console. If you see no such leaks, then you need to ask further questions.
