You can use this service offline (as it's done with JS) so how can they possibly ensure a unique address is generated?
I don't know what bitaddress.org does exactly, but just take some numbers into consideration:
There are 2^160 possible Bitcoin addresses. If you generate an address from a key pair generated with a good randomness source, it is fairly impossible to find a collision.
In conclusion, they can ensure uniqueness just by the negligible odds of picking an address more than once.
Although I don't know the specifics of how bitaddress works, this is true of any address generation: there is never a 100% guarantee that nobody else has generated the same address.
Bitcoin addresses are generated from private keys, which are (or should be) randomly generated with a cryptographically secure random number generator. Nobody checks these numbers against a list of existing ones, because nobody knows anyone else's private keys. Nobody checks the resulting address against existing addresses, because it's impossible. There is no way of knowing if someone generated the same address, but has yet to use it.
So why is this secure? Because the set is so large (approximately 2^256 possibilities), that if you are properly using a secure random number generator, it is highly unlikely there will ever be a collision. In fact, it is several orders of magnitude more likely that the earth will be destroyed by an asteroid in the next 10 seconds than it is that you will generate an address someone else already had the key to. Yes, it could happen...but that's the least of your worries ;)