Obviously if they are logging all actions of all users, and there's some decent retention period, they can find out how many people got unintended access and what all they did with it. Recently, I got an advice from a C-level executive to include such analytics in ASPSecurityKit [0], because that's what companies are looking for these days. This GH incident makes me consider his suggestion more seriously.