I passed my concerns on to a couple of their employees whom I know socially, and they informed me that they had passed it up the food chain, but I have never received any sort of official response, nor seen any public notification or acceptance of this situation.
When I received another virus-infected email at that same address this week, I posted a polite note on their Facebook page. Again, nothing.
If it was a company in any other field, I might expect this degree of nonchalance, but given the fact that this company is staffed by — and primarily services — geeks, I'm a little taken aback by their apparent reticence.
So, since the polite, behind-the-scenes approach appears to have no effect, I now throw it out to the group consciousness: Am I being paranoid, or are these folks being unreasonable in refusing to accept or even acknowledge that a problem might exist? What would you recommend as my next course of action?"