I suspect he did not use the API and rather emulated actions in browser. Action was performed on behalf of the user and data scope he collected was limited to one user using extension, which theoretically equivalent to a user’s execution of a custom script in js console.