I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?
if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?