Since GA is based off of Urchin, I assume that they are using something close to it. Urchin works off of a server's access logs. Primarily, it tries to set a cookie that is then used for tracking. The standard practice is to modify the access logs to include that tracking token in the log entry. If no cookie can be set, then it approximates a session based on source IP, user-agent, referrer, time between requests, etc.
I would imagine that most people are being counted multiple times, thus inflating the number considerably.