I just noticed something:
You can use Google News (Germany confirmed, others likely to do the same) to fake/hide the referer.

Proof:
news.google.de/news/url?sa=T&a ...
Now, in the Server log, as referer you have news.google.de.
This can of course be used for pishing.

I know, this is not the proper way to publish "security holes", but I lost my password for the BugTraq/SecurityFocus/Full-disclosure mailinglist :o)