Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
I don't currently use moves, but I do see it set to track me under location services. Messages is set to Never. That said, I can tell you that at least once in the last year, I have somehow accidentally sent a message to this friend sharing my location, a little map with a pin on it. But could that account for her ability to both see where I was weeks later, and to also name a number of locations I've been at?
Only if you shared your location, which I'm assuming can be turned off after sharing.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.