Yes, I suspect the more probable leaks are dew to malware and mistakes (someone want to post a kittens picture, but he makes a mistake and paste the doc url.)

And your comment is interesting. Are the proxy servers expected to be secure against a timing attack?

(Also, the proxy administrator may be able to see the logs ...)