Comment by falcolas

All the MITM has to do is relay the traffic to the correct secure location, passing the credentials passed via the compromised HTTP connection, and the user's entire account is compromised.

Remember: HTTPS does not ensure the identity of the client.