I have purchased four N900s. Only two of them have been flashed, the two purchased from fellow TMO members. The other two were from eBay: one sold by a pawn shop, who "did not know how to turn it on". All that was needed was to charge the battery. That one still had the last owner's personal data on. To the point that I could find who the last owner was and contact him directly, in case the phone was stolen (it wasn't.). The other one was wiped through the system menu, which means no contacts or email accounts but the Sent folder was still full. I suspect very few users, even advanced ones, are aware of that vulnerability.