Gaping hole in Google service exposes thousands to ID theft