StormN

There's absolutely nothing wrong with saying "between X and Y" in my opinion. You just always make sure X is what you actually want, and Y is at least 30% higher. Give them the opportunity to grind you down, it'll make them happy; give you the ability to say "look, I've already let you take X% off what this should cost" which will come in invaluable later, because it's an instant ego-booster for the other guy. Always let the other guy think he's won, simple rule.

A key point here is that he didn't use a proxy and doesn't seem to hide his identity during the sniffing around, which means he's either: a) stupid. b) not intending to do anything malicious.

I think a. is unlikely, because he did actually manage to break in, although, the hole itself might've been trivial and therefore this might not count. I don't think so, though. Which leaves b.

No, it's not. They have a large(ish) self-serve advertising platform like FB with various levels of targeting.