My guess is they read the analog signal from each bit location.
[previous bit value, current bit value]
A [0,0], [0,1], [1,0], [1,1] should give different voltage.
Thus given the current bit, will be able to retrieve previous bit info.
If this method is used, even after 3 bit writes may still be able to retrieve. Depends on the quality of the flash ROM used.