Knowing a little bit about how this sort of attack works, I'm thoroughly amused.
When I opened the email I laughed. A good belly laugh.
My first thought was, 'some WP users are going to be very pissed off, some are going to be paranoid and about 5% will laugh with me!'
The IP address will likely mean nothing - they're easy to fiddle with, which means you can zip through little holes in the internet to make it appear that you're in any random bit of the world you like.
The security of the site? Well, what sensitive information is stored on it? A bunch of usernames and email addresses, and... maybe some private forum messages. No credit card information, no phone numbers, no addresses. Worst case scenario is that you start getting spam, and you should be able to delete that with a click of the mouse anyway.
As to who did it, it doesn't have to be someone who uses this site at all. It isn't uncommon for someone in need of an ego boost to find a little exploit in a website, search for other websites using the same structure and pull them all down at once. To annoy one community is okay, but to do it to a dozen (or a hundred) on the same day gives pleasure to small minds.
Anyway.
The correct response to the situation is, 'ha ha, look! An idiot!' and then to continue with your day as if nothing has happened.
'Lets all have icecream!'
'Now that's what I call a sticky situation!'