The IT dept has no idea if he messed with their files in a naughty way. They will have to spend x hours and y moneys on checking now.

While finding the problem should never be punished if it's responsibly disclosed, exploiting it (publicly in this manner) should be.