You had to give permission when you installed it, right? Everytime I download a different wallet, Windows asks me...
No permissions were requested, plus the firewall is on my wi-fi router, and I know damned well it has no ports forwarded.
My guess is that they're using some sort of server polling handshake or maybe UDP punch-through?