I've emailed in the past -- goes into the junk folder, unfortunately.
Posting it is the equivalent of flashing the bat signal.
It takes 5 or 6 days for a domain to get hijacked (i.e. for a transfer attempt that is not rejected to automatically go through), so there's no risk in publishing it on the board. If someone did attempt a transfer today, it would NOT go through immediately.
Better that he know this way, rather than having an email from me sit in the junk folder for a week, while the domain gets stolen by others with the same knowledge.