The 19-year-old cybersecurity researcher who remotely accessed dozens of Tesla Inc. vehicles through a third-party flaw, has a new trick: hacking the car owners’ email addresses to notify them they are at risk.