Honestly, that's indicative of the original problem: Users need to take more care regarding who they share personal information with. Bounty participants shouldn't be sharing their real personal email addresses with managers, who are just anonymous people on the internet -- and they certainly shouldn't be sharing their KYC documents with them either.
The same goes for dodgy exchanges, and there are an abundance of those. Even if an exchange isn't intent on selling your documents, they may be overly lax about protecting your data. Even if they are extremely careful and take the necessary precautions, your info could still be compromised by a determined attacker. For that reason, it's important to minimize the number of exchanges you KYC with.