I took a look, and I don't think it detects inactivity at all. I think it just sets a timer and pops up a box after that amount of time. Depending on whether and how you answer the box, your session is logged out or not.
I looked into this a bit more, and I was wrong. What's actually detected is activity rather than inactivity. If you peek at the js rules httprequestscript and ruleformutilitymanager, and search in them for references to restartTimeoutWarningTimer, you can see in the context there that activity is detected when an ajax interaction occurs between the browser and the server. That activity causes the timer to be reset so that if, for example, it was counting to 5 minutes before popping up a box, the 5 minutes will be restarted when an ajax interaction occurs.