There is a lot of this. I am not a lawyer but unless you have a bug bounty program with specific terms and they signed up for it agreed to your terms you do no

There is a lot of this. I am not a lawyer but unless you have a bug bounty program with specific terms and they signed up for it agreed to your terms you do not owe anyone anything. Never reward threatening and abusive people with gifts as that marks you as an easy target. Same with communication, do not reply to them. Rewarding them will only encourage more of it, no different than ransomware. Create rules to put their emails into a folder that gets archived and never deleted in case you need it as evidence later should they escalate their malevolent behavior. If it escalates into extortion and fraud causing financial harm then federal agents will need the emails fully intact. All of that said there no harm in fixing things that people bring up.