The report address is generated with a random ending that cannot be guessed — that is the only thing keeping one client from reading another's report. Targets and the rest are set afterwards, on the client's own page.