What’s happening here is an abuse, at two different levels.
The discovery of a trackable (Geocoin or Travelbug) is, in theory, only possible if you have obtained the code by either holding the trackable in your hands or at least by having seen it with your very own eyes. Groundspeak themselves ask not to distribute codes openly so that only those who have seen the trackable may log it.
Furthermore, anyone who has already activated a trackable should already have read this information, it appears on the second page of the activation process (Screenshot 1).
It’s also clearly stated in the Q&A about the correct usage of trackables (Screenshot 2).
One could already qualify the discovery of a trackable from a list as an abuse. The distribution of lists full of codes that you don’t own is definitely and clearly an abuse.