Probably all they had to do was be transparent about the reason for sending out the emails, who they were, and probably throw in a link to that page (i.e. https://privacystudy.cs.princeton.edu). Seems like a silly thing to overlook but it does seem the impact on people is serious and I guess they know better now...