What would you do?

I have been tinkering with the API of a pretty popular web service and I discovered that the email address of every user is easily mined from the site. The issue I have is that they say that they do not disclose any personally identifying information but by combining different API calls you can trigger a disclosure of user email addresses. It looks intentional as well.<p>I am in the process of writing code that will allow anyone to harvest the email addresses but I do not want to make it public. Is the public disclosure of email addresses a problem or just something that I am worrying about for no reason? I feel like businesses should be more careful about how they treat customers and how they treat customer data.