How did I guess?

They can't in this manner. They are using an existing credit report for marketing purposes, which means they have no permissible purpose, which means they are in violation of the FCRA and their contract with the credit reporting agency.
Download this document:
http://www.ftc.gov/os/2011/07/110720fcrareport.pdfStart reading about half way down page 13. That section talks about using reports obtained for review purposes, but reports obtained to open a different account for the consumer is the exact same thing.
About the only thing available that would take into account someone's credit report, would to order prescreened lists from one of the reporting agencies. However, that has it's own risks, it's expensive and with little ultimate return in this day when every other piece of mail is a credit card offer.