hhm, how did they do that? I thought the google oauth flow required that it redirect to a google page (and show the info/permission the oauth flow is asking for).

Unless there's a security leak somewhere in cookies, which exposed your email address to this site (which doesn't belong to google i presume).