The discoverer had these choices:

- monetize the bug themselves; i.e. set up a site where you can submit a YouTube user id, pay some fee using your credit card and get an e-mail address.

- report that they have the ability to convert any YouTube id to an e-mail, with proof: then negotiate over compensation for the disclosure of the details

- just report the problem and be happy with whatever they get.

Ten grand doesn't look too bad for the most timid choice.