Don't forget when they took donations on behalf of other websites and kept the money unless the operator went to the "escrow account" to collect it
The issue which I found out about late, and fixed right away, was infringing on right to publicity, nothing to do with donations from users' own tokens.