Hi Chris,
You are missing something 🙂 that refers only to the bit.ly provided QR code which they did NOT use.
Essentially, the email/IM means no referer - that is, they clicked on the link directly - which is what a scan would show.
Hope that clears things up.
T