> abused oauth permissions to take over the email accounts of their users

Woah, never knew this. Do you have any reference? I cannot find anything about it.