We had this happen. In fact 7 items, whose links were never shared, were inactive but scheduled to post the following day, were found and used.
At moment, these items were never published and are still not published. I'm 100% sure the "create checkout link" was never made or shared. Yet someone found the links and shared them.
In fact the person who got this link casually added, "&donotleak" at the end of the URL.
I currently have this matter with support but I have a feeling they won't know how this happened and it could be a huge problem for myself or one of you in the future.
Shopify Discussion
Partners and Developers
