How does drupalxray.com find out the modules present on a thirdparty website?
I enabled access log on my site and then let www.drupalxray.com to review my site.

The entries in the access log looked like below.

HEAD /sites/all/modules/token_custom/LICENSE.txt HTTP/1.1
HEAD /sites/all/modules/active_tags/active_tags.js HTTP/1.1


As you can infer, looks like they have an exhaustive list of static files in all the modules that they can ascertain through their service. 


They are using HEAD requests to save the bandwidth.
If the HEAD requests return 404 response code, the module is not present in the code base if it gets a 200 response code then it can ascertain that the module is present.


However it would be good to know if they have a list of modules with static files or if they have automated that to find the static files all the module on drupal.org.

The suggestion to enable access log was made by Clive.

Note : Currently the services only looks at the sites/all/modules folder only. But I think they can easily tweak a little to make it more generic.