Here's a thought experiment:
Many people here seem to be okay with the idea of this being a punishable offense, but take issue with the length of the sentence (which I'll admit, seems excessive on first blush).
But what would an acceptable sentence be for hacking someone's email and then distributing their personal information? Maybe a year? That doesn't sound outrageous.
So if he did that, and was sentenced to a year in prison, and then got out and did it again, presumably another year in prison isn't unreasonable (you could argue for a harsher sentence because it was a repeat crime, but we'll ignore that).
So he did this to 50 different accounts. That's 50 separate crimes. He took a plea (which resulted in being found guilty of a lesser number of charges), and that got him 10 years.
I still think 10 years seems like a lot of time to spend in jail for a nonviolent crime, but shouldn't the number of crimes be used somehow in calculating a sentence?