Only authenticated people can request information, but we don't have proof that the information was used to claim a payment.
Having all the tools doesn't mean you used them. Insufficient for proof.
Discussion
Not sure in what context this kind of proof is necessary or useful but in the context of privacy it is neither. The request itself is all you need to draw inferences.
I'm really not sure what you're optimizing for if you're opposed to inferences?
You should be crying out against zaps if that's the case.
