Comment by Groxx

No, it's entirely the fault of GET. They're opening an iframe on their page with a source your post URL. If it were POST-only, they'd be blocked by Javascript being unable to communicate across domains.