How did you contact them by the way? I've been looking for ways to get in touch with them with a security related question but can't find anything, which doesn't look well on their part, especially with their security record.
security at wordpress.org Listed at http://core.trac.wordpress.org/
Members of WordPress.com are on that mailing list as well.
http://en.support.wordpress.com/contact/ if anything is definitely WordPress.com specific, but I suggest always including security at wordpress org, because there may be another permutation to the attack.
First I sent a email to matt(http://ma.tt/contact/). Then, I used the Automattic contact form(http://automattic.com/contact/)