Another I just saw was a keylog of someone changing their password after their Facebook account was flagged for suspicious activity. Obviously, they've got bigger problems.

Question: should I contact this person and tell them what happened?

(Thinking about it, it would be trivial to write a script that monitors for this kind of stuff, and e-mails the victim, or sends them a facebook message, explaining what happened. But, uh, seems like it might expose me to liability at worst, and angry reply emails at best.)