I know some of the server-based "anonymizers" (using that term generically) pull out the referrer; they may mask the browser string as well, I don't know. Could it be their servers have been victimized?