It's really a question of how malicious the author was- if they set it up to download everything attached to the account as soon as it connected, it could still cause a lot of damage.
(or is that somehow against the 'only our anonymized ad display program can scan your email' privacy policy?)