He seems to be in Australia. I don't think white hat security researchers are at as much risk there as they are in the US or the EU.
Yeah definitely the wrong people to piss off.
Someone using this in order to take criminal advantage of the previous owner's email address will most likely be using a fake identity, and most likely not care about lawsuits.
By the end he claims to have gotten a $250000 reward bvy facebook, which he has not claimed. Sounds to me like he has no intention of taking that reward, if true.