Do you have a Webmaster Tools account set up for the domain by chance?
If so, I'd complain directly to Google about it. After all, their own
help docs (it's the first one) state that they're breaking their own standards.
Not that it should matter since normal searchers wouldn't do a site: type of search. But still, the possibility exists that some rogue webmaster out there might use it. Of course they'll probably just tell you to use their URL removal service, instead of actually fixing the problem on their end.

That's what big companies do. As they've already stated at the end of the above document where they give themselves an out that they frankly shouldn't have if they're going to follow the specs.
Or, if you really wanna screw with them, drop an .htaccess in that subdirectory that looks for any of the Google user agents (Googlebot, MediaPartners, Googlebot-image) that sends their bot to a 404 error page no matter what page they request in your private subdirectory. You could even give the 404 error page an appropriate message deriding their implementation of the robots.txt standard, complete with flowery language. That could be fun.
Edited by Randy, 10 July 2008 - 02:05 PM.