But that ends up sending an email to the account you extend the sharing request to. It might raise a red flag to some people.

This 'vulnerability' doesn't contact the victim, so it can be done in combination with, like the report said, a phishing scheme to gain the real names of the users of an email list.

I'm not saying that this is some massive privacy issue. It opens up a vector to make other attacks, specifically email based attacks, seem more legitimate, which is a bad thing.