Yeah no shit. Do you think it's normal for an exchange to directly expose customer addresses and withdrawal amounts to other customers? Maybe it is normal. Do you think it's remotely acceptable?
Of course it's acceptable. Even Bitstamp does it. If you're using Bitcoin the way you're supposed to, there's no way to link the withdrawal addresses to any meaningful information, and you don't even know which addresses are going back to the exchange.
I guess it depends on whether you consider a database of exchange user withdrawal addresses meaningful information or not.
Going back to the exchange . . . yeah ok we're talking about the guys that send out a plaintext SMTP saying "hey dude you requested coinz withdrawn to address" whenever you w/d, I had to set up a new email account because of them. It's pretty obvious they're taking 0.001 from the w/d then bundling it into a pay to many with 0.0005 relayfee yay profit.