and so when an attacker configures thunderbird to slurp all the email out of your inbox this does .. what? why not just poll the list of most recently logged in

and so when an attacker configures thunderbird to slurp all the email out of your inbox this does .. what? why not just poll the list of most recently logged in IP addresses and track the number of currently logged in sessions/authentications, and when that number approaches a certain hair trigger, sound the alarm? oh right, google already does that for you...