I think Casascius did the right thing.
He has no way of knowing how many people got the phishing email, and no other way of contacting people who might fall for the scam.
If you're upset because you have to poke the 'delete' button on your email one extra time... then I think you're overreacting.