My biggest concern is not that they will get your email credentials, but the fact that they may have your email and a password to start tinkering with on banking sites, social media, etc.