Should we perhaps have sent the request through anonymized pidgeon? When you send an e-mail to someone you can find out quite a lot of information from headers, from a nick or a given name.

When contacting ISPs some people attach contact information so that the ISP can request more information, maybe even make a call to verify identity and discuss the matter to help resolve it.

This doesn't mean that the information is intended for the abuser himself. I'd expect the ISP to send anonymized information/questions to the owner of said service, and not just forward "everything" (especially without discussion with the reporting party).

Reporting DDoS and abusers risks putting a huge target on yourself, your company, your servers, etc.

That is what the issue is about.