“Here’s the problem: Google’s OAuth login doesn’t protect against someone purchasing a failed startup’s domain and using it to re-create email accounts for former employees.”
Buy a dead startup’s domain, recreate the old addresses, and sign in with Google to its Slack, HR, and payroll. Over 100,000 of those domains are for sale. Google called it working as intended, then paid $1,337 after the conference talk was accepted. It never said what the fix is.