You get a reject back fast enough for a bad ID that you chould just test a lot of them. I'd presume google has checks in place to prevent brute-force, but I'm not going to lock my account by trying.

My money for likeliest avenue of the link escaping would be on attack of your or Kate's browser that stole recent history.