Having slept on it, I would like to point out that I did gain complete control of someone else's account, viewed their personal information, and could have conducted transactions against any credit card or bank details they had set-up.

The reason its a non-issue is that this only happened because they set up the account with an email address they did not control, but that only became apparent later by which time this has got away from me.