Couldn’t they have done both? A verified status for the same reasons Twitter does, and properly handled the information. It should have been a verified account once and complete destruction of the submitted data. It obviously should never have been kept indefinitely and unencrypted.