I think that they have alerts for when an access token is found in the wild, for instance. So it is quite possible.