This is generally done by e-mail, so you'll need to
include our e-mail address (support@exch.cx) in CC (this is mandatory to claim the reward).
Shouldn't this be BCC? It sounds like you're "brute-forcing" reports on the abuse email addresses. It is of course ridiculous that one valid report isn't enough to take action, but if they think of your brute-forcing as spam, it's going to be very easy to filter and delete the emails if they all CC the same email address.
I second this. You have to use BCC otherwise the registrars are going to think that this is incentivized reporting (it is, technically, but you generally want them to suspend the domains, not pay attention to the fact that you're paying people to report them).