Twitter finds software privacy bug affecting direct messages