>Well there was the well publicised man-in-the-middle attack by Linkedin.

>They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining.

Isn't that technically not mitm? That would imply the user was using linkedin as a mail client/proxy or something. This is closer to fraud or phishing.