Steps to reproduce (on a wikifarm with some single sign-on systems that uses autocreation, such as CentralAuth):
The AbuseFilter log event will be attributed to user A and the account name variable will be B, exposing the fact that the two accounts are owned by the same user.
Log record example: http://en.wikipedia.beta.wmflabs.org/wiki/Special:AbuseLog/27870
https://gerrit.wikimedia.org/r/#/c/288902/ will make autocreations log the same user as created and creator.
which was reverted due to unrelated difficulties and then merged as https://gerrit.wikimedia.org/r/#/c/292606/ and cherry-picked to 1.27. So this should be fixed for MW versions newer than 1.26.
@dpatrick should we make this task public (and close it as resolved)? The info leak is for 1.26 and older only, and very hard to trigger. I doubt we want to spend any effort on fixing it.
1.26 has been EOLed for two years now. Not to mention that the single sign-on requisite means this would only have affected a tiny fraction of installs. Closing and publishing.