I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.