Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom

Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.