That's like saying that it isn't robbery if the door was unlocked.
It still is. Any reasonable person would know that stealing from a house, locked or no, isn't something they're supposed to be doing.
It's a quandary, to be sure, because once you discover a hypothetical exploit, it's human nature to sate that curiosity by testing whether it works. Two or three accounts would have proved it, 100,000 accounts is excessive.
I'm not trying to say that the number of accounts he released is germane to the discussion per se, but I certainly think that it's relevant in the discussion of intent.
