Time and stress. Not a lot for a monetary reward there, but that may be enough to get Brightcloud to commit to doing better (or at least being very careful with syphilis's site). The SysAdmin may have a case, though I'm guessing that would be contract law, so maybe not (probably some verbiage about false positives in the contract to cover it).