If their 8.8.8.8 resolver was returning results from customer accounts that weren't verified, like the GP seems to imply, that seems like a huge security problem.