A number of answers for this. Some already stated.
1) If you get filled on 1 share on a hidden order, it is usually an HFT program pinging the various exchanges, or dark pools to map the hidden liquidity.
2) Its also a way for HFT to gauge which orders are real and which orders are other HFT programs. When your 500 share order becomes a 499 share order and stays on the book, it is mapped.
95% of orders, especially on big caps are just fleeting HFT liquidity, so knowing which orders are real and which orders are not is a huge edge. That 1 share tells a big story in the mapping of real liquidity.