I don't think that having two days between the contact and the fix is acceptable for something as crucial as reading anyone's e-mail. I wish they had locked down access while investigating the bug once they confirmed it (which should have taken minutes). Leaving such access open for any time after knowing about it is grossly irresponsible in my eyes.
