Wasn't it was worse than that? I think they used to ask for your email and password explicitly for the contacts. Twitter used to do the same as well as some others. Here is a blog post from 2008 about Yelp doing it, but I can't find anything for Twitter (though I definitely remember it being the case back in the day, a comment on this blog post also mentions it) https://blog.codinghorror.com/please-give-us-your-email-pass...