Use correct username/domain in report_vuln

It would be nice if 'vulns' showed this