Pay particular attention to (2).
If I am an attacker, say a government agency, and I want to check on a person in particular? Nothing you do is going to matter here.
This means that it is a single static database query: their user account information.
But this is your most likely scenario! This is how our law mostly works! It is also the way a lot of these attacks work (that someone is gay doesn't matter until they are inconvenient and you are looking for something on them).
3/