Do you have appropriate robots.txt in all your site roots? I know in the long ago past, I had a private site that got indexed by Google, even though nothing links to it. My suspicion was that someone who used the site used the Google toolbar to browse to it. I asked Google to take down the listing and put up a proper robots.txt file and they complied right away. Nowadays it's probably Chrome phoning home to the Big G, so your secrets are hardly safe anymore.