If I understand correctly they setup '<a href="https://twitter-unfurl-faker.herokuapp.com/" rel="nofollow">https://twitter-unfurl-faker.herokuapp.com/</a>'. When twitter creates the preview it uses a Twitter user agent so the website is returning different content (or a redirect). Then a non-twitter user agent is used to access '<a href="https://twitter-unfurl-faker.herokuapp.com/" rel="nofollow">https://twitter-unfurl-faker.herokuapp.com/</a>' then it redirects to <a href="https://harrydenley.com/faking-twitter-unfurling/" rel="nofollow">https://harrydenley.com/faking-twitter-unfurling/</a>