This is clearly a huge programming blunder.  Despite promising to call me back with an update I have had no further correspondence from QB regarding this. I'm planning to ring them again this week.  It makes a mockery of offering restricted access when it's not restricted at all.