Attachments inside a privatemessage can be downloaded without logging in (if someone knows the URL).
Because of this, for some reason, some private attachments are being indexed by Google.
...