Months ago a relatively large figure on nostr publicly said they were going to ask another user if they could reveal their identity in relation to a questioning post from a third party. 

They then proceeded to DM the public profile of the anonymous user using nostr DMs with public metadata. It was a relatively insignificant thing and the identity was shared publicly after so I didn’t raise this as a big deal, but it was still a fail from someone who should have been aware of the issue.