So when GitLab finally bothers to respond they do so from a new account? Any proof this comes from GitLab?

Which terms specifically does it violate? The terms page you linked to is 10k words long.

As others have mentioned, this is not about responsible disclosure. If those merchants have the good of their customers to heart, they will act to cleanup their sites and disclose the breach themselves. If not they will move to censor this to avoid losing face, maybe not even bothering to remove the malware. And you're just helping them with this.