Ah, I see the misunderstanding. The behavior I'm seeing called "normal" is people being punished in response responsible disclosure, where the actual guilty party is illegally leaking private information. I'm comparing administrative abuse to domestic abuse.

If changing a few characters in a URL was a crime, I'd be gone for life.

edit: and, I'm using "normal" in the same sense as the comment I was originally responding to: to indicate an everyday occurrence