Yea, this is really bad. I've done some searching of the data. Sometimes it doesn't matter. It looks like whoever is currently running gab.com is probably a big consulting company with like 100 other clients, so there's no big relation there. But if you run a small personal blog and use the same e-mail address for maybe more controversial sites that are hosted on different IPs, now you could get doxed.

I'm guessing customer IDs are associated with e-mail addresses? This seems like a good case of using different e-mails for ever cert. There are open source tools like anonaddy.com you can host yourself or buy from them (they have a decent free tier).

I feel like this list seriously needs to be pulled. There is some serious lack of oversight here.