1. Anything related to the transaction can be logged.
2. Same as above.
If you would like to see actually what can potentially be logged than I suggest you go grab a packet sniffer like Ethereal
and see for yourself. Just turn it on and then check your email, or browse to another computer. You can then go back and dissect all the packets so you can see for yourself all the crap that is sent in plain text and totally logable.