Most likely the downloads are not individuals, but automated NPM services or mirrors pulling it.

Back in the node 0.2 days when NPM was just launched I created a Twitter bot that tweeted out every new package (stopped it after a year) - theres used to be a endpoint you could just scan for new packages popping up