If you think you have found a bug, please report it at https://bugs.kde.org. This is will help get it solved as opposed to every other course of action.
Great! My advice is you politely comment on it with your own experience or your insight into what the correct behaviour should be. This will not only give devs a measure of the importance of this bug, but will also keep you in the loop of the process of its resolution.
The risk is low. Your email address is not visible by the general public. A spammer would have to go through a manual registration process to see it. Sounds like a lot of work for a small niche number of email addresses.
Either way, when in doubt, do as suggested: use your spam-catching email address.