Or it didn't really use Oauth, and just outright stole his password.