[nucotano]

How exactly does this work at a technical level?

[r1ch]

I recall there was a followup to the article that confirmed that he had granted access to his gmail (or someone in his network etc). What the article describes should not be technically possible.