Why not just send an email with the vulnerability information instead of playing email tag. Why not send an email with something like "I found a problem with feature XYZ and here are the steps to reproduce and using these steps I can do ABC". Problem solved.