That does sound like a lot of hassle indeed. I hope it's worth it. Also you probably did the right thing by PM-ing those who had there PMs exposed. It's a good time to remind people that PM stands for personal message, not private message...
Note: PM privacy is not guaranteed. Encrypt sensitive messages.
Do/did you get any compensation for the effort you had to put into this?