I never gave them password to my gmail account, and yet they somehow harvested an email I never used for anything. I wrote about it here: https://news.ycombinator.com/item?id=6935606 . I suspect they stole it from my phone when I installed LinkedIn app (never do it).