The Details

Figure 3 shows the Valet M10, still connected to its two antennas.
Figure 3: Cisco Valet M10 board
Figure 4 shows its WRT160N (V3) equivalent. Looks like the same board to me!
Figure 4: WRT160N V3 inside
Moving along to Figure 5, we see the Valet Plus M20 board. The heatsink hides the Broadcom BCM53115 Gigabit switch, but I know it's there!
Figure 5: Cisco Valet Plus M20 board
Figure 6 shows the Linksys WRT310N (V2) board, which looks mighty similar. The heatsink on the BCM53115 switch was removed for this photo. Notice the resemblance?
Figure 6: Linksys WRT310N V2 board
Since both the M10 and M20 use the same Broadcom BCM4716 Intensi-fi XLR 802.11n 2.4 GHz Router System-on-Chip, how does the M20 get three antennas out of the same chip that handles only two on the M10?
Figure 7 shows the M10's RF section detail, which uses two SiGE SE2528L 2.4GHz Power Amplifier with Power Detectors, with receive / transmit switches for each antenna.
Figure 7: Cisco Valet M10 RF section detail
Figure 8 shows the M20's RF section, which appears to have the BCM4716 receive and transmit traces for each antenna going to S2364164 devices (sorry, Google came up empty on those). Traces from those devices then feed into a third antenna, which serves both receive chains. As mentioned earlier, the third antenna is used for receive only, to provide a bit more gain to try to enhance range.