I've given the answer to this (possible reason) previously. But, since it's a localhost.
You've two options from here:
1. Keep Questioning yourself about this and not casing out.
2. Case out any possible way and make yourself more secure.
If I were you, I would go with 2.
P.S.: It's good to question but not at the cost of casing out. I would case out any thing which can be the possible reason.