They leaked accounts that are legit, who cares about the source when Coinbase confirmed that this instance with some random unknown list 'only' impacted 1000+ u

They leaked accounts that are legit, who cares about the source when Coinbase confirmed that this instance with some random unknown list 'only' impacted 1000+ users. Sure, but they could also not care if there are duplicates. You don't need to polish your list output for a proof of concept code, whatever he needed to prove was proven. It's not a vulnerability, it's data leakage. Sure you put a wrong name in, most people did not. And it's not the name that's a concern it's leakage of email addresses that would be prime target for savvy hackers who want bitcoins. If you could run random addresses against an API offered by a vendor that sells safes for high value valuables and get a match which houses have those safes you become a target. Sure most people won't try to break in, but those are are in business of doing so will try.