AFAIK it also leaks the list of all your logins (or rather the sites) through their favicon caching server. To turn this off you first have to login (wtf?).

Do you have more info on this?