This sounds hauntingly familiar to something that happened to me on United's site: http://blog.tinfoilsecurity.com/132969897

United, in spite of all their other faults, handled it fairly well at least and responded quickly.

Ben here. Other info thankfully didn't seem to come through or be present in the response. But still gave me pause and not something I wanted my name on :)