Does anyone expect GitHub to intervene as the (partial) host here? Does this put them in a legal situation?
"This repository has been disabled.
Access to this repository has been disabled by GitHub staff. Contact support to restore access to this repository. "
Not really. GitHub aren't liable for the initial upload due to safe harbor laws. If the dump is fake, then there's no problem for GitHub. Life goes on.
If the dump is real then potentially the owner could force GitHub to remove it, but in doing so would have proven the legitimacy of those files, which is something you don't usually want to do.
GitHub may, of course, choose to suspend the account for their own reasons (I don't know, for example, what their T&Cs are for running auctions via their site, but it's probably not allowed).