Lol. With all the information I got here I guess I and my referrals are screwed then.
I have a private email/browser service with privacy guarantee (automated VPN browser included with random access points). All my referrals use that service to stay anonymous so they most likely don't know which IP and even which country/city was used for their bounty sign-up. Since I assume the form Authorship will release tomorrow will check the IP (if it matches at least the area they used to sign-up) through another confirmation email none of my referrals will be matching that former IP.
Not good. Especially because he wrote before that the tokens are automatically sent.
Everyone suffers when referrals are going on - it's bad for the project, for investors and for honest bounty managers.
In the end, you can check the registration refer and see if they just came by copying the link, without a referral source.