I'm not sure if this is actually a problem? You wouldn't share your password-recovery e-mail with anyone either?
I guess it's not the best thing to do (and not telling you to not share that mail), but a tremendous security hole? Are the login-tokens they use in the URL guessable? It not, I think that might be a little bit exaggerated...
I don't think there are actually that much differences between different tools, because the JPEG compression is standardized. If your default image tool (I prefer GIMP), supports a level-based compression control, you just need to figure out how much details you are willing to lose. Here is a good article on that:
http://www.codinghorror.com/blog/2006/07/a-comparison-of-jpe...