I've recently had the experience of getting a spam email that allowed the spammer to add an appointment to my Google Calendar without my permission - even though I never enabled such a feature, never communicated with the sender before, and didn't reply or star or have them in my contacts. Wtf.