It proposed emailing the HF user it stole credentials from, right? It should've asked for a responsible adult in OpenAI.