A problem with Gmail authentication - security loophole?

[Windows Central Question]

This morning I found some suspicious stuff in my mailbox, so I decided to change all passwords. Just in case. Brilliant idea, is it not? Well, since at work access to stuff like Gmail and some other things which are not work-related is blocked, I asked my wife to do this operation at home on our home PC. So she changed my gmail account password and never told me the new one. But hello! My Lumia 1320 still pulls & sends email using that account. How the hell is this even possible?

 

[hotphil]

It's using an app password?

 

[RumoredNow]

https://support.google.com/accounts/answer/185833?hl=en

 

[kurtd]

It does seem like a security hole. The password on my gmail account was changed almost a week ago. Yet my Lumia is unaffected. It still syncs email perfectly fine. In fact this email account was one from my former job so I shouldn't have access to it anymore. I know the password was changed because I tried logging into the web interface and I couldn't, it said the password was recently changed. It seems like google should expire those app passwords when master password is changed.

I guess I'll just delete the account since I don't need it anymore. However, people who lose their phones and think they are good after changing their password are mistaken...