>4. An IT/corporate security department that is okay with them sending all of their keystrokes, login info, and browser data to a 3rd party service

Or just an IT/security department that is blissfully unaware of the shenanigans that some of its users are up to. Especially if people are accessing this from outside of the corporate network to start with.