You think thats bad? I don't know if it's still the same today, but a few years back I helped an executive who was being spied on by his wife. She logged into his twitter account on his phone and was monitoring his DM's. He changed his password to try and prevent it and it never locked out his wife's login with the old password. Apparently, that token just never expires and a correct password isn't necessary. It was pretty hilarious to us.