Aren't invites tied to the inviter? Seems like buying an invite, and figuring out the inviter would be the simple way to identify the person. No snooping required. (Unless you consider the invite algorithm snooping).