I'm surprised that anyone finds this surprising.

Yes - when an entity (agent, or hacker, or whatever) gets into your account, they can do anything they want.

I thought this community understood security better than this.