When it comes to leaving the private key on the client systems then I would have to refer to Hanlon's razor.

It could simply be a stupid mistake, social media make stupid mistakes into big deals but they're not a new phenomenon.