The credentials only give access to the users data so they damn well should be free to give those credentials/data* to whomever they please. Keyword give, Microsoft shouldn't build a de-facto keylogger.

* Ideally they should be separated like through OAuth, but that isn't an option for an ancient standard like IMAP.