The only answer in my opinion, and this goes for any website with a security issue, is just not to use their service.

They either don't care or have a long list of higher-priority issues than this. Either way, nothing you can do.