I’d assume the user running this bot would be responsible for any crimes it was used to commit. I’m not sure how the responsibility would be attributed if it is running on some hosted machine, though.
I wonder if users like this will ruin it for the rest of the self-hosting crowd.
Why would external host matter? Your machine, hacked, not your fault. Some other machine under your domain, your fault, whether bought or hacked or freely given. Agency is attribution is what can bring intent which most crime rests on.