John's replies appear weird to me.
Don't exclude the possibility the web server to be compromised (and
likely all John's boxen, he had some troubles with PGP keys) and someone
included the alleged logs on purpose.
Recently read leaked presentation that TLAs use such operations.