Calling apple support and raising hell until someone makes a mistake is more social engineering than email address security vulnerability.