Even if you get sued, how would they know it's you? ie. how would they know who to serve a lawsuit to? By the time they get a court order to take the data down

Even if you get sued, how would they know it's you? ie. how would they know who to serve a lawsuit to? By the time they get a court order to take the data down, if they even bother, people will have already distributed it, and it'll be another 09:f9:11:02-type fiasco. I hope he releases the code he used, although I wouldn't really blame him if he doesn't.