Not that I think this is even remotely likely, but they could be storing an MD5 hash of all but the last four characters of your password, and an MD5 hash of your full password. Since MD5 works by processing data through the algorithm bit by bit, with each operation producing a valid MD5 hash up until that point, they could take the first hash and 'continue' hashing with the rest of your password, and then compare it to the full hash.

TL;DR: You can take an MD5 hash of any data and generate a valid MD5 hash of that data plus some data of your own, without knowing what the original data was.