You're completely leaving out the possibility that the client gave others the code.
Lol, never thought about that, it's highly possible.