Chances are, they are a beginner. This is someone’s side project not a site backed by a huge corporation. They deserve responsible disclosure so they can learn from it.
On the flip side, if such an embarrassing exploit is found in the first hour, maybe it’s the equivalent to making the student read their note out to the entire class as punishment?