This is why the so called responsible disclosure isn't a silver bullet. I believe, in cases when there is no bounty program and no substantial risk for the users' data or resources, one should go with full, anonymous disclosure.
This is very hard because the actual research required you to use real accounts, and you would need to contact them to correct your account after you proved it was indeed an issue.