> How can you not mean to? It's my understanding that they used to do this entirely intentionally at one point via an "import contacts from mail" feature, then

> How can you not mean to? It's my understanding that they used to do this entirely intentionally at one point via an "import contacts from mail" feature, then they dropped the feature and now when they added the "sign in with e-mail to verify your identity" feature someone reused the old code without being aware that it will also harvest the contacts and that they don't want that this time. It's the opposite of "privacy by default", basically.