Ok, scratch "anybody able to sniff their traffic" (assuming both sides use the native gateway.) This still leaves the IRC server itself as a potential vulnerability.