Yodel's mobile parcel delivery app was leaking people's delivery data to others using the app, a security researcher discovered.