I'm pretty sure most mail clients will not directly include any of the headers from the original e-mail, unless you do "forward as attachment"

It only includes the headers of the last email in the thread. But that doesn't guarantee that the person forwarding the email hasn't changed what someone else wrote in the quoted reply text. To me that's actually a serious security issue, and in the long term is more serious than the OAuth thing (which I'm confident that Google will eventually fix).

If I'm wrong and it's possible to do then by all means I'll do it though. The one approach that would work is building an InboxSDK plugin and having it forward every message in a thread automatically, because that way you'd have the header of each message. But then the security story is arguably much worse than OAuth.

I don't believe that is correct. If you check the email source, it includes all the emails with their headers.

What email client are you using? In Gmail the only thing I see between quoted replies are blocks like:

--000000000000061f91056a2a279c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable