Currently it is legal for a company to truthfully state that it has not received any NSLs. Therefore, we can assume any company that won't outright claim such a denial to have received at least one.
They've pretty much outright admitted to receiving them:
"We've urged the government to allow online services to disclose the exact number of national security requests received in a reporting period without revealing details about specific requests."
Absence of proof in a place where you would expect to find proof is strong evidence of absence, though. A transparency report which includes sentences like "We want to report the exact number of national security requests we receive, if any" is a pretty blatant statement that the number is greater than zero.
