anallawalla - 3:02 am on Jun 6, 2012 (gmt 0)

But they could be in Google/Bing for all I know.

It would be useful to your cause if you could check that and report back. I believe what g1smd is trying to establish is whether someone can execute a query by changing your URL variables, causing non-approved pages to be created, at least enough to get them indexed.