Brian,
We have some agreement here, but first:
No crystal balls and maybe you could work on reading comprehension. The point is that it was only a secret, and if you don't have any idea what happens with secrets once you tell a "trusted" group yet, then let this whole mess serve as an example. When the only safeguard is a "secret", it is foolhardy to think you are safe. The site was not hacked into. Or as they say, "loose lips sink ships". Do you get it yet?
Very well said Rich, and your speculation only further illustrates the whole questionable concept of needing a "secret", and what it implies.
To where we agree Brian. Yes, they now have a dilemma of wondering who they trusted that they should not have. That is their problem. I would suggest that they not only need to find this person for their own peace-of-mind should they continue to need "secrets", but also so as to reevaluate their entire protocol of needing secrets, and then wondering how much "trust" they can put in trust. I'll bet there's a chapter on it in Rich's book about "Running a Website for Dummies" (post 350).