You've done enough. Unsolicited critisim of any code is a very delicate subject. What the author decides to do with your justifiable concerns is a function of his or her integrity as a publisher. There is a whole lot of bad code floating around on the net and it is fortunate when someone such as yourself is observant and concerned enough to take the iniative to draw attention to the present dangers. You should sleep well tonight knowing that you've done all you can and should. If this author fails to publish an addendum I will be greatly discouraged by his or her lack of care for the audience.
-Jason