I have the iPhone app and under my account when I log in via the web, it says API is disabled. I don't recall it requesting to be enabled for access when I set it up originally before the app was pulled.
It could be that the app uses the api key (despite it being disabled), and somehow someone was able to steal it. I hope it isn't sent in plain text.
I can't speak to their architecture, but the mobile app must be using some kind of API.