That is true, my email could be compromised.

But: my browser - which I use to access my email - is locked down to the point that a normal user probably wouldn't find it much fun, between umatrix and adblock plus there isn't a whole lot of javascript that runs before I authorize it.

Agreed that it is possible. But still unlikely.