Because target WAS trying to login to BAD.

Imagine a "free porn, login here" website, when you put in your gmail address it triggers the onetime code from gmail (assuming it did that type of login) - thousands would give it up for the free porn.

Oh I see. Misread the whole scenario.