Just an update: the author states on Twitter that he already had notified Xerox a week ago [1]. Apparently, Xerox has only now contacted him because they thought it was a joke [2] ...

[1] https://twitter.com/davidkriesel/status/364345036407709697

[2] https://twitter.com/davidkriesel/status/364329334300880896