Given how long this has been a problem, it would be interesting to look back through access logs to find attempts to use this.