I would guess that this is still more likely some scam infrastructure middle man setup, and one of their customers chose to use it to make threats / do more tha

I would guess that this is still more likely some scam infrastructure middle man setup, and one of their customers chose to use it to make threats / do more than just scam people. It seems unlikely you'd setup a scam setup like this and out yourself by making threats to government officials via your own infrastructure ...