I said crawling URLs not tweaking address bars (implying scripted mass process). The other point is that the sentence in this case whether reasonable for other reasons or not will be a reference point for future prosecutions against less unlikeable people.

Legally in the US there seems to be very little protection for privacy (unlike copyright) whereas in the UK Sony has just been fined £250K for failing to adequately secure personal data (PSN hack).

Should this person have collected more than 100K email addresses? - NO.

Should they have blown the whistle or reported it straight away? - YES

Were they criminal? Probably just about.

Does what they joked about matter? No unless they actually tried to do it.

Does the fact that they wanted to harm AT&T matter? Not much for me, AT&T harmed themselves and while discoverers of the flaw could mitigate AT&T's harm and these guys chose not to for me that doesn't turn it into a crime although possible does suggest additional sentencing is appropriate.

Is 10 years an appropriate sentence for accessing information that legally had less legal protection than copyright works? Definitely not in my view.