I think it likely WAS illegal, although for that you'd probably have to be able to prove intent. But even if the guy claims it was simply a mistake, unless it's just a single digit off the actual number, it's an enormous potential embarrassment to him and the whole company that he even KNEW that number. Whop him with a harrasment suit. I bet he settles big time and fast!