Would there be any way for a user to see if/when the token has been reused? Doubtful but perhaps Google provides (or could provide) some kind of log similar to how Facebook lets you view Active Sign Ins and Sign In history.