Comment by immibis

They also don't know the random elements used in previous headers, since they're thrown away a few rounds after the message was decrypted.