The system uses the proprietary PBUCON system to connect to a dynamic list of servers and receive the punkbuster logs from each via encrypted udp packets. Servers must be correctly configured to allow a connection to be established and a connection will only be established once a server has been checked and approved manually (more to prevent any old server being added via the web interface than security).
A separate port is required for each connection due to the way the PBUCON system works. Mainly so it doesn't get confused between servers as the header system isn't particularly robust. An internal UDP port is also required to provide an interface to send commands to the PBUCON process.