they probably extrapolate statistically from looking at the number of people who download patches and extra content. I've noticed this myself. I had more people download a mod for one of my games than actually bought it. given that maybe 20% of players would even find out about the mod, that shows you have a lot more people running full versions than paid for the game.
It's not a 100% accurate method clearly, but it lets you get rough order-of-magnitude figures.
I think they made lots of mistakes with crysis, but pretending piracy didn't hurt them is silly. it hurts all PC devs.