A roundabout way of doing 1+2 could be to find a reputable journalist and explain the situation to them. They could publish a story (possibly requesting comment

A roundabout way of doing 1+2 could be to find a reputable journalist and explain the situation to them. They could publish a story (possibly requesting comment from the site owners first) on it and keep you anonymous. This could be a way to do the right thing while lowering your risk of being charged with violating some antiquated hacking law. But also talk to an attorney before doing that.