>It's standard security practice to serve user submitted content on a separate domain, so I'm a little surprised that Google isn't following it.

But it is being served under googleusercontent.com?