While it might be the case that they have a vulnerability somewhere, in that [the email address of every user is easily mined from the site], there are few reasons to [write code that will allow anyone to harvest the email addresses].

Yes, [businesses should be more careful about how they treat customers and how they treat customer data], and I agree you should submit some sort of proof-of-concept to the web service, privately, to improve [how they treat customers and how they treat customer data].