[_pergosausage]

After looking at the source code, it looks like all it does is send a copy of itself to somebody in your inbox, and nothing else.

[shmed]

We dont really have any proof that this is the only code that got executed. Whoever owned the OAuth account had direct access to your information from google's servers, he wouldnt need to go through you as a client to get it.