Those things are all fundamentally different from "the logic in your code is dangerously flawed"

Maybe I don't understand the situation correctly but the tweet was: "Hey @KidsPass - when do you plan on doing anything about the massive security issues with your website?" Followed by a link explaining <wavy-hands> how important it is to be secure. </wavy-hands>

I can understand why someone could block that as spam, especially someone who host such a blatant security flaw.

Apparently the researcher was blocked after he sent a series of DMs explaining the issue. The exasperated tweets came later.