"How can anyone read your GMail contacts without your logging into your account?"

Google (and others) provide an API for doing this specifically to prevent users entering their passwords into 3rd party sites...