Creating a nuisance is not a good way to go about it.

Some security practices sometimes feels like someone stabbing you just to prove you could be stabbed. Then they point at the wound and say: "See? You should be more careful."

Yes, the risk is real, but creating harm to demonstrate it isnt the same as protecting people.

Well, ruining everyone's day on that particular host is not a nice way to "bring this to attention".

If I ever experienced something like that, I'd be banning the person (or limiting their resources drastically) for 60 to 90 days to bring the impact of this matter to their attention.

Anything affecting users on a system is not harmless.