Per the abstract, it sounds like they just... scraped a bunch of email addresses out of the commits in a tree? Is that newsworthy? There's one sentence in there about "targetted phishing attacks", but nothing to back it up.

Please someone tell me this is more than just email address harvesting?