I actually think requiring a small but reasonable fee to get personal information out of Whois would help prevent spam, etc. Paying $2 dollars to get the contact info for the owner of a hacked site doesn't sound unreasonable to me. Perhaps some sort of organization wide monthly access for a fee would help these "security researchers"