Do you have a reference with more information on that?

They used a legit google oauth but with broad rights. They did pull the contact and repeatedly spam them as personal emails. There were lawsuits.