And that's why I leave location services disabled by default and never sign into any Google account from my phone: it has been obvious from day one that this sort of abuse would become commonplace.