What was disclosed?

The fact the is a vulnerability/exploit to get the true email address exists. Has now been publicly disclosed so people know it exists.

What is the vulnerability?

They aren't going to disclose that publicly.