You can now decide whether you want to alert the vendor about that list. I would be compelled to, except for the fact that the vendor might be pissed that you pointed out a flaw and press charges for "hacking". Probably unlikely scenario, but I remember reading an article where a guy was able to open a website and actually save the results. He was sued or something after pointing out the flaw to the website owner.
I guess it was a good thing that you had your doubts.