People saying he should of gotten more than $5k, it sounds like he accepted a decent sum just to spend time looking with no requirement to find bugs! To me, that sounds like he was compensated fairly from the go and any extra is just a bonus.
I remember last year someone discovered a very similar bug in Google's Webmaster tool that would let any person remove any site from Google's search results[1]. It's a wonder that bugs such as this are there in Google's site.<p>[1] <a href="http://searchengineland.com/google-disables-url-removals-after-bug-allows-anyone-to-remove-any-site-86352" rel="nofollow">http://searchengineland.com/google-disables-url-removals-aft...</a>
While it would be great for him to get paid more than 5k for such high nuisance value bug, it'll be a bit difficult to figure out a metric to fairly put a price on a bug. Bug bounties are based on efforts and not on what you happen to find. Its like a lottery and it seems just about right for companies to keep a standard reward for all bugs. I really like the idea of paying for time spent+bug reward though.
Like other serious business flaws (e.g. the GM key ignition bug), companies weigh the risks and can conclude that it is cheaper to respond the problem than to fix it proactively. As a result, should the government require businesses with sensitive data to implement bug bounties?