I mean...there is a whole discussion about the questionable ethics of the research methods in the verge article. And human subjects and issues-of-consent questions aside, they are also messing with a mission critical system (linux kernel), and apparently left crappy code in there for all the maintainers to go back and weed out.
1) once hypocrite commits were accepted, the authors would immediately retract them
2) I don't think it's unethical to send someone an email that has bad code in it. You shouldn't need an IRB to send emails.