At a minimum the reporter could have googled Sam to find out he teaches security and the range of classes: http://samsclass.info/

... or applied some logic. Instead of contacting them directly he could have:

* broadcasted it to the world (maybe a reporter!) that the FTP server was insecure * do/say nothing