I personally would be concerned that someone has access to your client files, perhaps via malware, if these are returning clients who you've actually spoken to.
