Trajectory Recovery From Ash: User Privacy Is NOT Preserved in Aggregated Mobility Data