Hi Nico!
Referrer can be blank in case the direct URL was used. For example, some posted the URL in the social media and asked his friends to vote for the entry. What is suspicious is the same platform and the same screen resolution. Also pay attention to time till vote - if it is small, then a visitor does not explore the page and try to vote immediately. But that probably mean my previous example - posted URL with the text to vote for entry.
Have you enabled IP or Fingreprint check? Also try to enable cookie check.
By the way you do not obligate to look into the database, because you can export votes to CSV from the components "Votes Log" view and then open it in Excel, for example.
Kind regards,
Dmitrijs