I could be mistaken, but it sounds like they messaged an admin, and did not publicly disclose it. (Other than messaging someone else about it?) Honestly, it so

I could be mistaken, but it sounds like they messaged an admin, and did not publicly disclose it. (Other than messaging someone else about it?) Honestly, it sounds like the person here isn't highly familiar with vulnerabilities or disclosure. They probably saw the ID and thought "huh I wonder if I can change that" and then tried two different numbers there. As you state, they should have stopped after one, but they probably didn't expect it to even work the first time.