It's under the assumption, that servers have one player from one IP with TONS of MCs.
The stats are probably like this on servers where it is easy to bot:
[40% of players do not MC]
[50% of players MC 2-5 clients]
[8% of players mc 6-10 clients]
[2% of players mc 11+ clients//lets pretend the max is 20]
So, lets pretend everyone MCs the most possible clients with 1000 players online.
[400 players do not MC] - 400 players counted
[100 players MC 5 clients] - 400 players counted
[8 players MC 10 clients] - 32 players counted
[1 player MCs 20 clients] - 4 players counted
So instead of this server having 1000 players online, it will show 836.
But now lets also add in people who use tunnels.
Out of the 836 players left it could be:
[60% do not use a proxy/tunnel]
[20% use WTFast] - Out of these 167 players(20%), 4 are counted.
[15% use ReduceTheLag] - Out of these 125 players (15%) , 4 are counted
[5% use PingZapper] - Out of these 41 players (5%), 4 are counted
So now we have reduced 1000 players to 515 players.
By the way, in this example, 491 MCs are open on this server AND are being counted.
And 321 players that are just using a proxy/tunnel are not being counted.
Also, the one guy who is spoofing 20 clients, is probably using virtual machines and can make the IP appear different.
So the guy you REALLY want to catch, gets away with it, and the guys that MC 5 characters, you only catch 1 of them (20% success rate).
Then, the people who use tunnel/proxy, you catch most of them since they are all on the same ip.