By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.
Have a look at this list, many of them thought they are not doing anything wrong:
https://en.wikipedia.org/wiki/List_of_computer_criminals
The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.