Sandra has confirmed that the tracking is based on cookies, without duplicate tracking mechanisms.
Good point. Yes, I've heard cookie stuffing was a much more serious problem in the past. I think some of it still goes on today. It sounds like the big change that reduced this was affiliate programs switching to overwritable cookies, which mean the last referrer gets the credit rather than the first referrer. Even with overwritable cookies, cookie stuffing could still result in a program paying affiliate commissions on referrals that were sourced through non-affiliate means, so programs themselves are not entirely protected, but the overwriting at least protects affiliates.