"email addresses are part of the metadata for each individual commit. When those commits are pushed to remote hosting services like GitHub, those email addresses become visible not only to fellow developers, but also to malicious actors aiming to exploit them."

Isn't this overblown a little bit? If it's part of the metadata and it's pushed to a public space, how is it a 'large-scale-exploit'? I might be ignorant of a few things here so would love to be corrected on this.