No require, no include, no url rewriting, yet the script is executed without being in the url

I am trying to trace the flow of execution in some legacy code. We have a report being accessed with

http://site.com/?nq=showreport&action=view

This is the puzzle:

• in index.php there is no $_GET['nq'] or $_GET['action'] (and no $_REQUEST either),
• index.php, or any sources it includes, do not include showreport.php,
• in .htaccess there is no url-rewriting

yet, showreport.php gets executed.

I have access to cPanel (but no apache config file) on the server and this is live code I cannot take any liberty with.

What could be making this happen? Where should I look?

Update
Funny thing - sent the client a link to this question in a status update to keep him in the loop; minutes latter all access was revoked and client informed me that the project is cancelled. I believe I have taken enough care not to leave any traces to where the code actually is ...

I am relieved this has been taken off me now, but I am also itching to know what it was!

Thank you everybody for your time and help.