Disclosure reveals new area of privacy risk for the company and illustrates how difficult it is to inventory unauthorized activity tied to its agents