Twitter says user data meant for security purposes may have been used for advertising