Twitter has claimed a bug in its system may have caused direct messages to be leaked to third parties for more than a year.