Lots of ways they could find that URL. Off the top of my head:
someone could have bookmarked the URL on one of the social bookmarking sites...they get crawled all the time.
Your servers log files (some server side log file programs are easily crawlable).
and as you said, someone could have linked to that page on their site...referenced it in a forum, etc...and no, people will generally link to the whole URL unless they are very web savvy and know that the variables are simply analytics information.