Intent is what matters. Writing code can most definitely be evil when written with evil intentions, or with the expectation of having the code used in malicious ways.

It's a very different thing to write code with good intentions, only to have it repurposed by others for nefarious intent.

It's obviously not a black and white matter, or we wouldn't be having this discussion. The important thing to remember, though, is intent. What was that code or feature originally intended to do? If it was intended to be malicious, then why write the code?

I actually do not believe this is really a legal issue, and is instead a moral and ethical issue on a personal level. It is only becoming a legal issue because we have no other way to deal with it, since not every person operates on the same moral code. If more software developers went out of their way to hold themselves to a higher ethical standard, maybe fraud wouldn't be as prevalent as it is today, and we wouldn't need to have this discussion in the first place.