Tagged sucks, but the article omits the key fact that it only sent out emails to your contact list if you gave it access to your email account. It wasn't as simple as "Any click resulted in the same thing, Cuomo said: Every person on a user's contact list received an email".
Blaming only the company doesn't help people learn the appropriate lesson of "don't share your password."