How does Drupal ensures that the one time unique URL used to reset user password does not get transferred away inside the http_referer header?
At this point in time, it doesn't.

There's an issue to fix this in Drupal 8, after which it will (hopefully) be ported back to 7. Patches are currently awaiting review.