It is notifying all users, and by users we mean accounts. If you want to get into semantics, some of them are duplicates. If the emails aren't correct, that's just unfortunate. This is what's called making a good faith effort to notify at the email address they provided.
The problem with your attitude is you decline to make any such effort, in stark comparison to the attackers. 40,000 community members/developers are not worth the effort unless there's XP involved, right?