hi
i checked about 20 spreadsheets of bounty campaigns. and in these lists i found about 15 private keys to ETH addresses.
people post their key instead of their address.
all the addresses had nothing in it. maybe somebody else already emptied them.
It will only takes minute to empty all those wallets and there are people posting thier private keys in public with balances but the thing is you cannot withdraw the funds on that wallet because once you send eth on that address, after recieving the eth it automaticaly send the eth to unique address.
of course you can empty their balances as long as you have their private keys because private keys are the ones you will use in order to open your myetherwallet account and most bounty campaigns especially erc20 related coins/tokens are required to get a myetherwallet account because it can supports all kind of coins and tokens whether it is old or new. but overall we cant do nothing about it and those people who actually do it are just careless enough or maybe they were just newbies that still confuse on what is a private key and eth address.