Amazon admits it exposed customer email addresses, but refuses to give details