[danielweber]

Yeah, it's tough to really know who leaked. Alice and Bob both know secret S, and each can blame the other if S is leaked, but neither of them really knows who did it.

There have been some research projects where unique and unguessable passwords were made in laboratory conditions and securely given to sites to see if they managed to leak. I trust those a lot more because they often lock up the email addresses and never use them. From what I recall some big companies did give out addresses they promised not to, but that's not a blanket condemnation of all businesses.