Even if you get sued, how would they know it's you? ie. how would they know who to serve a lawsuit to?

By the time they get a court order to take the data down, if they even bother, people will have already distributed it, and it'll be another 09:f9:11:02-type fiasco.

I hope he releases the code he used, although I wouldn't really blame him if he doesn't.