The fact that they're passing the data back with an image tag instead of an XHR request also suggests the same to me.

If this was some leftover debug code, I wouldn't expect it to be that sneaky.