In that case it's going to be simple to find them, something like: grep /log-in server.log to find the admin user id which logged in around that time and

In that case it's going to be simple to find them, something like: grep /log-in server.log to find the admin user id which logged in around that time and viewed that page from an external IP. I'm sure if they really want to they could find the IP at least, and track which user accessed the resource, which other pages were accessed, which will probably lead them to the leaker. Quite a lot is logged by default by the web server usually, and then on top of that their app will do more logging, maybe even associating page views with user ids.