Does using an unofficial API authenticated with someone else (e.g. a customer)'s account count as a violation of the ToS? In other words: who gets reprimanded/sued? The final user or the messenger?
I do think this violates their ToS anyways though.
If it was Unofficial-API-As-A-Service, I'm pretty sure both would be in violation for most services. The user at least for sharing their account credentials, the UAAAS provider likely for some thing in the fine print about only being allowed to use the website for the intended purposes. I doubt either will get sued, the user will get their account cancelled and the provider will get their servers blocked and an angry letter from the lawyers telling them to stop.