Though I've never actually investigated the process, I would imagine that they simply reverse-engineered the protocol for getting a server listing that the game itself employs, by sniffing the game's connections using something like Wireshark.
Once they have a list of servers, a similar process is used for getting player and map information, except from the servers themselves.