When you access it while using Mullvad, it still asks you for your account number. Service should automatically detect you are on VPN and let you search, why the need for the extra step?
No "might" about it, that's one of the most important traits of this type of service.
Seems like a security risk.
If so it's like 16 digits. Isn't that 10^16 values? If they had 1 million users, that's still a lot of numbers to test before you find 1 valid one :)
I suck at math, but that's like 999999999 non-existing accounts per valid account? (10^16 - 10^6 - 1)