It was getting the favicon for the domain name of the emails not sending the actual contact list to anyone so you're spreading misinformation by shortening this

It was getting the favicon for the domain name of the emails not sending the actual contact list to anyone so you're spreading misinformation by shortening this to "The developer was scraping contact lists and using that to query third party servers". Also that's very different than "sending/sharing contact list data.", it's not, it's querying the domain names to get the favicons. So I get why the author wouldn't want to declare that he is doing that when he isn't. To repeat what I said below, reading the code, say you have in your contact list: b@acme.com a@acme.com c@google.com The code makes a single request to acme.com (to get the favicon) and one to support.google.com to get that favicon (there's a special case for google to avoid getting the new doodle of the day). That's it. No one gets the contact list, the most anyone gets is that your ip requested a favicon.