No good deed goes unpunished. If you send a shocking email, he'll track you down and have the police arrest you for identity theft. It's really in your own best interest to not send him anything.Because if you notify them in a very memorable way, they won't make that mistake again. While I agree that a simple, "Hey, just wanted to know that I picked up a discarded external HDD for repair and it turns out that it's full of your personal data, including SSN and banking details" along with a link to a good system-wiping software (like DBAN) would be a bit more "polite," I can completely see the argument in favor of "shocking" the person into better security habits.
ZV