[54mf]

All we know for sure is that (a) they counted the number of files, and (b) they read a filename. I'd be willing to bet they don't even know who the user is - in a properly normalized database, all they'd likely see is a user ID unless they explicitly have an interface that correlates user ID and file data with personally identifiable user information.

Perhaps saying, "it was a cat" was a poor idea if they only read the filename, but a lot of people are making a lot of assumptions here. If you're dealing with regulated or high-value data, you probably shouldn't be using 37signals without doing any kind of audit of their operating practices anyway.