The Hacker was able to submit tickets on HackerOne Support (https://support.hackerone.com) under the identity of different people. We've resolved the issue by changing a setting in the Freshdesk Software.

Something that's different from usual reports we get is that this was an asset not considered in scope, so we didn't have a concrete bounty table and it brought our team to the drawing board on how we want to handle such reports. Whilst we want to encourage hackers to hack on non-listed assets belonging to us, and also out-of-scope assets (i.e. for managed services) that are on us, such as misconfigurations or information disclosure.

Currently, it's not something we have clear guidelines for. We opted to give a bonus without bounty instead to speed the process along.

Regarding limited disclosure: Many comments in this thread are not directly in scope of the report and would lead to broken conversation cycles if we made them internal.