That's the purpose of sending attempted uses of this exploit straight to the highest place possible: so if he does, they know

Working with him to do what? He pissed about a little with WebInspector, it doesn't make him a security consultant

He threatened to do more damage to your site, why wouldn't you suspend someone like that?