Sorry, I thought you were just asking how these things knew about the db.
Ok. Look in profile.update.php: See errors = edit_user($user_ID); ?
That’s where the magic is happening. So, we ask ourselves, where is edit_user()? Well, we follow the “include” trail back to admin-functions.php (via admin.php) and, down around line 342 we find edit_user!
Thanks, I was skimming past that line seeing that it was doing error handling but completely missing that the errors were evaluated from the return of edit_user(). I figured somewhere there had to be many $_POST references.
Took a few cracks at it, but you caught the little magic spell I was after.