It is down to how they detect bots, spiders, and other unnatural traffic. Obviously the domain registrar was simply counting how many visits there were to the sites and not just from actual real people. Also they might not be distinguishing unique visits - eg if I reload the same page 50 times it doesn't mean there's been 50 visitors - there has been 1. If a google IP visits a page 1000 times it doesn't mean there's been 1000 visitors - there has been 0 real people.
This is why, when buying a domain based on traffic, you should *always* ask for a complete breakdown of each visit. From that you can deduce how much traffic is real and how much is being redirected from other sites or is from search engines/bots/spammers.