I think the idea is that OAuth token would allow sending emails as a specific sender, like if I allow say Lyft to send me emails in this flow and the pass the key to spammers the emails will appear to come with Lyft.