Tor will help you by hiding your identity so they will be in a dead end when they sue and try to find you.

And yes of course you can also use Tor to contact them anonymously before disclosing.

Besides telling me to use tor (which I know in general what it is), is there a guide I can use ? (i.e. how to send / recv anonymous email on tor from a non tor address ?) or something ???

Use the following to get a live OS with Tor preinstalled: https://tails.boum.org

Once you're in there you can just use the Tor browser to create an email account at any email provider (make sure you give them fake details though) and send your email.

Which email provider allow opening an account from a known tor exit node ?

Rjevski suggests you publicly disclose the vulnerability in an anonymous way that can't be traced back to you.