Do not do this. If somebody started running port scans against me and sending me unsolicited emails about "potential vulnerabilities," I'm marking it as spam and reporting them to their hosting provider if I can track it down. It's way too close to the "it'd be a shame if anything happened to your site" thing that companies I've worked for have gotten for comfort.