Programming in JavaScript for the web browser is mostly "event" based. A user clicks something, that's an event. The page finishes loading, that's an event. You submit a form, that's an event.
When the page tries to unload (you try to navigate away or close the window/tab), that's an event as well. You can add code (called an "event listener" because it "listens" for the event to occur) that returns either true or false to an event. If your code returns true, then the event goes ahead as planned. Return false and the event is cancelled. There isn't a whole lot you're supposed to be able to do in the onbeforeunload event ("on before unload" -- this event "fires" just before the page tries to unload), but you can put up a scary "are you sure" message. That's to prevent the user losing their data, as I said. The labels on the buttons and the title text on the dialog come from the system, you can't change them, but the text inside the box is yours to word as you please. If you click "Leave this page" (or whatever your browser puts in the button), the event gets a "true" result and goes ahead.
It is possible to run a teeny, tiny bit of code in the event as though, as long as it's small enough to finish before the page unloads -- and that code runs with your permission, which is much higher than the website's permission. (It runs with your permission because you clicked.) Sometimes that very short time interval is all it takes to do something you would probably rather the site didn't do to your machine (or do on the web with your credentials). I'm not saying that this site is malicious in that way, but between the pop-up itself and malicious code everywhere on the web, users are reluctant to click things. They'll believe that they're at gunpoint now -- "if I try to leave, he's going to hit me with a virus or something".
People like this guy rely on that fear to get signups, and it works.