[retailbuyout]

A) this doesn’t require a rogue agent, just an insecure one. B) you just need the same attack to work twice; less extraordinary than an uncorrelated coincidence C) possibly some might have access to both. I think this is unlikely, but again, less unlikely than an uncorrelated coincidence.