The only surprising part of this story to me is that someone cared enough to attempt to quantify it and that there were attempts to limit the abuse in the past.

It's so well known that the databases are abused that people often say that if you want information, you just need to know someone in law enforcement. I don't know if it's true, but I've sure seen that written a lot.