The problem here is that GitHub allows this - anyone could have taken advantage of it. I don't know if the guy did it deliberately or accidentally, but that's b

The problem here is that GitHub allows this - anyone could have taken advantage of it. I don't know if the guy did it deliberately or accidentally, but that's beside the point. GitHub are in effect operating a spam relay by permitting anyone to email 400k people. I don't know what the solution is - whether it's limiting team sizes, or adding restrictions that only org admins can trigger such notifications when there are so many members. But if the underlying problem is not fixed, this will happen again.