Not sure about the whole spoofing the referrer thing, but the rest can be done by combining some various php functions.
Basically, all this cgi looks like its doing is pulling the content off of the page, stripping out the tags that aren't checked, and ultimately writing a local file with the rest of the remaining text.
Take a look at the php manual at some of the following functions:
htmlspecialchars(), addslashes(), stripslashes(), html_entity_decode, etc...
There are others in play here, but I can't think of them off of the top of my head.