if they are on your local net you are owned yes, that's why you have a hopefully have a router, using a public ip address on anything else is crazy.
thats the only way someone is going to be able to sniff out what URLS people are going to.. unless your/some ISP has been compromised... if thats the case the hackers are going to be after far better things than NFPS accounts...
again, stealing someones account info is useless.. it will jsut get the account terminated.