Using emails like this is usually found during pen tests. Not Googles fault I would say even though I think OAuth is overly complicated. This is along the line

Using emails like this is usually found during pen tests. Not Googles fault I would say even though I think OAuth is overly complicated. This is along the line of sending secrets in the token. Tokens are signed, not encrypted.