I wonder how much these retrospective results are influenced by a documentation bias or reporting bias. When a patient has an event [e.g. stroke] their history is carefully evaluated, and a risk factor in the past (e.g. pneumonia) is likely to be reported and documented in the EMR. Therefore you will always find more history (pneumonia) in patients having an event (stroke) than in patients not having the event, which leads us to conclude that pneumonia is a risk for stroke.