The string is what I was thinking of - the tampon itself shouldn't show up, but the string clearly should, and technically, could also be felt by a really zealous searcher.