Yes. Every export of 40+ rows has its row order subtly watermarked (a handful of adjacent rows silently swapped in a pattern unique to that download) before it's handed over, and that pattern is recorded. On Export Log, under Identify a leaked file, paste the record IDs from the recovered file in the exact order the file lists them — the tool matches that ordering back to the export event and shows you who ran it, when, and from which IP/network.