Even worse, what they're doing is completely unnecessary and probably more work than it should be. They can just request access to your contacts list using one of Google's APIs. Instead they're probably doing something far more complicated, using your email password to get access instead.