[wccrawford]

Wait, was the 'URL Exploit' the fact that there was a URL at all? Because otherwise, the 'exploit' was that they asked only for information that had recently been stolen.