Short version: you let a travel site "Access and read your emails", ostensibly to have it scan for automated flight booking emails, etc. You forget to remove t

Short version: you let a travel site "Access and read your emails", ostensibly to have it scan for automated flight booking emails, etc. You forget to remove the permission because you're going through the airport and (if in USA) getting the royal TSA treatment. Later on, someone human from the travel site can sift through the emails. In theory, they might need to if you call them and say "I need to know my flight info", but for most uses, that never happens. But you never removed the permission, so they get to read through it. Not really the fault of GMail as such, though they'd be wise to get out in front of this by introducing a default 3-month self-expiration on mail access. Wouldn't eliminate, but would limit this issue.