[rksprst]

If you really want, there are fingerprinting techniques to uniquely identify a user without using any cookies. (e.g. combination of user agent, installed fonts, screen resolution, screen depth, city, country, ip, etc...)

So they could do it that way.

[wtallis]

For users with NoScript, that list is reduced to user agent, IP address, and the inference that none of the other tests were allowed to run.

In other words, they could make it work, but only until they enable IPv6.