Hello,
if i'm not wrong, the plugin doesn't look for password at galleries, and also it don't consider access permissions (everyone, only members etc.), so it will shows any thumbnail of images own by a user.
I think it could be fixed easy into sql query putting the exclusion for galleries with restrictions or with password set.
Could this be considered an accepted feature request
?