Indeed. Assuming they have some kind of logs for legitimate use in place (X was logged in and requested X), how hard would it be to add a bogus record, request

Indeed. Assuming they have some kind of logs for legitimate use in place (X was logged in and requested X), how hard would it be to add a bogus record, request it and see who looks it up. If it's accessed and the logs are avoided, there's probably something leaky. Assumption is a dangerous thing, however...