Why not actually pay the people whose privacy it violated?
Surely the class action should mean it pays everyone whose email it exposed since these were probably scrapped by every bot in the world... Which probably means it owes everyone with an email address...