Perhaps this is less surprising than it should be, but it turns out Twitter illicitly misused the contact details they’d requested from users, supposedly only for 2-factor security purposes, in order to to let advertisers target them.