I don't understand how this is proof. OpenAI can easily have guardrails that prevent queries asking for other users information.
Well, it's the best i got. I would expect it to hallucinate, but i would not expect it to hallucinate restricted content and then tell itself it's forbidden.