Some time ago, I got access to someone’s Hawaiian Airlines account in a similar way (story here). In the end, I just noted the havoc I could have caused, and took just enough action to terminate any of my potential access to the account (and me receiving any emails about it).