In my opinion, you can and should write them an email. Otherwise you should do nothing because it's not your business. The security of a website is the responsibility of the website owner.