I'm pretty sure that changing your password does NOT revoke your oauth scopes, which was the attack vector here.