When a server is online, the connection between it and the client is encrypted.
When you join a server, it generates a session key or session code, which could be used only for one online mode session.
So now, think that there is a proxy between the client and the server.
First, the connection between the client and the server is encrypted, and so the proxy can't listen, say or do anything. Second, the proxy cannot switch your connection between servers because your session key or session code is only valid for that one connection (proxy).
Hence, as a result, bungeecord requires offline mode on servers to work. And for the IP forwarding part, this basically lets Bungeecord authenticate (Mojang) the user just how it does on normal servers, and then sends data to the login protocol stating that the user is authenticated.