Don't you have this problem with any 3rd party email client that doesn't use OAuth? With bigger projects it's going to be pretty improbable that a malicious commit will get pushed to the trunk, but still, with small projects and hacks like this it's always a possibility.