I don't get why he tried to approach them in the manner he did - first nudging them on Twitter with a relatively cryptic message and later dropping a fairly easy to miss text file (sure their system admin/IT sec should have picked up on it) rather than just doing a full disclosure in a formal manner to the owner of the company via a legal representative such as a solicitor, etc.
Almost like he is trying to generate drama and be a bit fractious.
EDIT: Infact the whole thing is ****** childish in manner - complaining about them not notifying customers while being obtuse about the security issues because they didn't jump through his hoops - why not just do a proper full disclosure via one of the many formal ways of doing it these days?
EDIT2: 90% through the chain of events and:
I looked to my admin panel records, found “User ID 1” (Jonathan Endicott, CEO of SlickWraps) and sent a very concise email.
Given the seriousness of it... why not do that in the first place?