A Hide My Email bug exposed real addresses through bounced spam messages for over a year before Apple patched it, just days after public exposure.