Here are four simple things that Path can do to right the ship, but the clock's ticking...
Don't wait for Apple to approve the 2.0.6 version of your iOS app with the opt-in feature. That could take days or weeks.
Allow users to delete their address book contents via your Web portal right now. (And do us a favor and dispense with the PR sounding "Automatic Moments" crap, we know that it's just spin for automatically share our location).
Promise that the Address Book data that you've already compiled will be permanently deleted.
Beg for mercy. Don't spin it or try the "it's a feature" garbage, either. Just come clean and tell your users that you screwed up.
It's quite simple really. If Path did the above by tomorrow, I'd consider re-installing the iOS app. But if it doesn't, Path will suffer irreparable damage and users will defect in droves.
Path already dodged a bullet with it's creepy automatic location sharing "feature" and I'm not sure that it can pull another rabbit out of its hat unless it takes immediate and decisive action.