Thanks goatpig.

So to confirm. What would be leaked, and how are they able to create substitute addresses without the seed?