Can still sync email after revoking app specific password on gmail
What's going on is that your phone is not using your password. When you log in an Oath token is issued. 
This is more secure, because your password is not stored on the device. It also has the additional benefit that it can automatically log you in in your browser. To deny access to your phone, remove the authentication token here.

Moreover starting with ICS you don't need to use applications specific passwords for your phone. Enter your regular Google account info; it will notice that you have 2-factor authentication enabled and open an internal browser where you can log in using your OTP.