The "research" was completely legal, right. Not involving accessing or using computers you didn't have explicit access to access? If not then you'll probably be considered as guilty as the cracker you were chasing if Netherlands has something akin to the UK Computer Misuse Act.
I'd hold off contacting the EC3 if I were you.