Not sure what you mean
"They read the search from Google (via the Bing toolbar), and rank their own results accordingly. Bottom line: they're stealing search results, using Google's page rank system as part of their own.
As I said above, all they are doing is registering the links people *click on*.If everyone clicks the third result in Google, that's what gets upranked.
"I'm not sure how you could link a given word to a webpage without scraping parts of the page (or link) first, "
It's actually pretty simple. When you you visit a page, the Bing toolbar queries IE for the address to that site. If it detects it's a search (like Amazon search, Wikipedia search, and yes, Google and Yahoo!), it also notes the search terms by pharsing the URL (and fills the search box on the Bing bar with said search terms.)
When you click on a link, that address replaces the previous one in IE's address bar. The Bing bar then gets *that* address (and sometimes the page title) from IE, and sends it along with the rest of the information it collected. The indexer then determines that people searching for that search term or on this page found this link relevent (since they clicked on it). User clicks, nothing more.
This is opt-in, and (as I recall) can be turned off without affecting the user-facing funtionality of the Bing bar.
As you can infer, Google's ranking is irrelevent except as far as it's relevancy to the user. As I said above, if everyone using the bar clicked an option other than the first, it would rank higheron Bing.
"but assuming it works on pages other than Google, it wouldn't take long for anyone to set up a basic click-the-link script for IE, and tada! "
The trouble is fourfold:
1) As Bing says, this data is a small part of the total data that makes up ranking. I'd surmise that top link for "torsorophy" got high enough (because of the share volume of people clicking on it) to get noticed by people searching through the pages, and from there went up naturally (that is, clicked on by people without Bing's toolbar as well as with.). For it to work, spammers would have to have thousands of individuals clicking their links - no easy feat - and then hope that it doesn't get buried because most people don't find it legit enough to click on it from Bing itself (with or sans toolbar).
2) Why couldn't they just set up a script that clicks on links from Bing itself, if it was so well influenced? The Bing indexer (MSNBot or whatever it's called) probably has algorithms that scan pages and try to determine the probability of them being legitimate or not (lots of internal links with random keywords, nonsense paragraphs, lots of random words after each other, lots of adsense stuff, ect.)
3) The Bing bar also sends a unique session identifyer that (as far as I can surmise) expires when you close your browser (and, of course, your IP information). If lots of clicks were coming from the same computers all at once, and/or continuously, they could surmise that it's a spam attack and ignore them. It also likely brings into account things like if clicks from hundreds of computers were either on a schedule or only occuring once, and if they all occurred within seconds of each other (such as in a distributed bot attack).
4) The fact that the Bing bar collects clicks has been known about since at least 2009 (when Microsoft briefed analysts about it), and I believe is also part of their privacy policy (if not explicitly, then implicitly.) I would think that most of the dedicated spammers already know this, however Bing search results seem* uncomprimised.
*Seem, of course, meaning "I haven't noticed anything".
A lot of this "what does Microsoft do about the spammers" is specluation, sure, but it seems like the logical thing. Your concerns would probably apply whether or not they used Bing bar telemetry, but , whatever they're doing to account for that, Bing seems to be holding up mostly fine on that regard.
And of course, one thing is clear - Bing doesn't copy Google's results - they use user clicks as part of the ranking system, and whether the links are in a certain order or not matters little - it's about what the user finds relevent, and the first link might not be it.
Obviously, I'm of the opinion that this is a legitimate technique, and I think Google should be doing it too, if not already.