It's actually pretty easy. Just because what is listed on the label may be totally within legal product to take, all it takes is one tainted bottle of legal supplements to show a positive test for PED's. These supplement manufacturers produce many different supplements, some legal and some illegal in different sports. It isn't that far fetched to think items can get a little mixed up and cross contaminate each other.
True. Its also not that far fetched to think the players actually take PEDs and hide behind the fact that the NFL can never release what they tested positive for.