Their claim that his exploiting the vulnerability (in a completely benevolent fashion) was not "responsible disclosure" is bogus.

They need to stop trying to cover their ass and just apologize for suspending the guy.