Someone could have right clicked "copy image path" and opened it in a new tab to try and get it directly. I do this all the time on the web.
There's no referral data on the tab, as it's new.
There are also anonymizer, proxy, vpn, tor, etc that strip referral data when building a page and following links (through various means).
Scrapers for example just open a new socket or thread for their queue for next level scraping and directly call the link, rather than it being followed organically.