It looks as though users can use the mail plugin to send themselves documents which they are not allowed to view.