It runs Send in Docker. I set up this configuration for it: https://github.com/timvisee/send-docker-compose
If someone sends an encrypted email containing illegal content, is email then considered harmful?
You design a system that gives you (the hoster) zero ability to inspect, modify, block, censor, restrict any of your users' content and in doing so you're allowed to abdicate all responsibility for how the system is used because you're literally incapable of controlling it. Pure infrastructure with none of the messy real-world bits.
I've thought about it though, but haven't settled on anything yet. I can't inspect files. I'll add an abuse report notice soon, abuse@ is already live. I'll attempt to manually review cases. That doesn't prevent illegal sharing, but I think that's the best I can do. If things get out of hand, I might take the instance down. I don't want to support hosting illegal stuff.
A newer Send version (yet to deploy) also shows a clear warning, and requires users to tick a confirmation box, when downloading through the webpage. I hope that helps preventing malware installations.
Between the short TTL and E2E encryption, I'm struggling to think of any legal obligations you would have in most western jurisdictions. Perhaps logging in some places? Even the DMCA permits more than 24 hours to respond to a takedown notice.