Are there any actual standards for how abuse reports should be handled by service providers? What Hetzner is doing here appears to be pretty reasonable to me (it matches what companies like Level 3 and nLayer do).

I can understand why you might not want sensitive email forwarded to the abuser, but why would you send that information in your initial complaint? For all you know, the person you're reporting to is the abuser.