Maybe it's simple. They could be clicking on a link in your email from their traditional email program. Unlike webmail, it will show up as direct.
Lots of web users get to sites in unexpected ways. Instead of clicking your newsletter links, they could type them in google, cut and paste the link into their browser, or they use pre-existing bookmark, or create a new one and test it.