I'm also convinced they use Google Analytics to find new URLs. I've seen URLs that I only had in AJAX calls indexed before (and I fired events to GA on these URLs).
They have expressly denied that in the past. (Where "that" is "using user data for Google Analytics to expand the crawl set". They're also on the record as saying "no use of toolbar data.")
The more likely thing you are experiencing is Google reading your AJAX URLs, either by evaluating JS or by using heuristics. Google is known to do both of these, but a lot of HNers get surprised when I mention it, so FYI.
I once had a spammer hit one of my contact forms a few hundred times on a page set up to capture traffic from South Dakota. there was a corresponding goal set up in Google Analytics that triggered and a week or so later the S Dakota page popped up as a site link on SERPS. Certainly doesn't prove anything but the page got essentially zero traffic and had no external inbound links and wasn't weighted very heavily in term of site architecture. Makes me wonder if there isn't some careful parsing of words in their claims. /removestinfoilhat
The more likely thing you are experiencing is Google reading your AJAX URLs, either by evaluating JS or by using heuristics. Google is known to do both of these, but a lot of HNers get surprised when I mention it, so FYI.