Basically, it works by having a session identifier, that is a random string. This session identifier might be valid for lets say 3 minutes.
The reason it knows you have closed the window, is that the session will no longer be renewed, thus your session will expire.
The reason of using such a system, is to prevent people from spoofing MAC-adresses and IP-adresses to "steal" a other's login session.
The popup is often delivered over HTTPS, so once the original user stops using the session, theres no way for the attacker to keep the session alive.