Are you sure the login flow used the official flow API and not collected the login credentials themselves to "helpfully" register the user?

I haven't used to app so I have no idea, just a thought.