Alexa
Alexa runs a large number of DNS servers and with it's partners is able to monitor a chunk of the DNS traffic for the Internet.
With DNS traffic data Alexa can see the number of queries performed for DNS records. Using this data they are able to create relatively accurate estimates on the number of HTTP requests a domain gets.
I say relative, because it's relative to the sample size. The more DNS queries a domain record gets the more accurate the estimates.
There are a few problems using DNS traffic to estimate visitors. Firstly, DNS records are cached at multiple levels down a network. Alexa can only see when a DNS request is made but not how many times a visitor hit a website using a cached DNS. Furthermore, the DNS query itself does not define context. Are the lookups done by a automated system or a human using a browser?
Alexa can use correlational statistics to pair visitor traffic numbers with DNS query traffic. They can further refine their estimates by classifying websites into categories.
This would produce accurate estimates that FaceBook is more popular then Google+ simply based on the number of www.facebook.com DNS searches performed.
One of the reasons people do not trust Alexa rankings/traffic numbers is that they check domains in the low percentile of statistics, or because of traffic location.
When people visit a domain the DNS lookup traces to a DNS provider near them, and often Alexa is never involved. So you could have a blog that is very popular on the East coast, but this hotspot is not visible to Alexa. For Alexa estimates to be accurate a website needs a broad range of DNS queries from many different areas.
I have two blogs that have the same traffic, but Alexa ranks one much higher because one has more international visitors. The other is popular among Canadians most. Therefore, from Alexa's perspective the international one has more traffic.