I'm using version 2.7.5 (released Jan 11), so this might be a bit newer.
Each widget is a user control, and is hosted in a WidgetContainer.ascx. The WidgetContainer provides all the common functions like the title renaming, positioning, expand/collapse, editing, etc. The source file is in the root "dropthings" folder. Looking at the Init method, we can see where the UserControl instantiated & added to the page:
protected override void OnInit(EventArgs e)
{
base.OnInit(e);
var widget = LoadControl(this.WidgetInstance.Widget.Url); //Here's the magic
widget.ID = "Widget" + this.WidgetInstance.Id.ToString();
WidgetBodyPanel.Controls.Add(widget);
_WidgetRef = widget as IWidget;
if (_WidgetRef != null) _WidgetRef.Init(this);
}
So, first the WidgetContainer is added to the control tree for each Widget configured. Then as each container is initialized, it creates then adds the specific UserControl to the page. When
WidgetBodyPanel.Controls.Add(widget);
is called, it will initialize (OnInit) the specific widget. From there the contents of the widget are in it's own hands.