My guess is they're looking at the HTTP referrer field in their server logs. Normally, a CSRF exploit shows up as an HTTP request originating from a different

My guess is they're looking at the HTTP referrer field in their server logs. Normally, a CSRF exploit shows up as an HTTP request originating from a different site (i.e., other than mtgox.com). I think the referrer can be spoofed, though, which would disguise the exploit in the logs.