Exactly.

Thinking about this starts to border on paranoia, but if the document is written by a sufficiently determined organization, it's all possible.