[marvvelous]

> Not only are they reporting trivial issues, but they also aren’t testing our site in a respectful fashion, by doing stuff like signing up to real events with fake profiles.

2nd to last paragraph mentioned this which seems like the real issue behind this whole article. Receiving a couple of security emails a day isn't a problem but the fake activity sounds like it's bad for regular users.

No idea how to stop something like this though, maybe put up a page for bounty hunters with some clear guidelines on how they're expected to act?