Sounds like this guy knows way more than me...

“It is too much,” Solovewicz says, emphasizing that people shouldn’t assume a domain is unmonitored. “I’m at the point where this would now be a full-time job to handle every single one of these—that’s part of my motivation to talk about this, it is my responsible disclosure. You guys need to fix your systems and not do this and not leak your customer data and your employee data and your own internal data.”

But couldn't he just set up an "out of office" so that every single time he gets an email, a response is sent saying:

Hey bro, this is a real email address, you just sent me stuff you probably shouldn't. No big deal, but you're going to keep getting this automated emails. Please fix your security.

If you get stuck in a loop of automated messages (likely) that's going to flow a massive flag up at the company, and someone is going to look at it why it's happening.

It's impossible for a human to handle it, but that doesn't mean it can't be handled.