This is very wrong if you ask me. Especially when you think about what is THEKEY in the first place. And even tho they can actually delete documents, I think this is not the main problem. The problem is: documents are clearly not encrypted. And as for me they should be removed from the site to be stored in some more safe and secure place.