If this idea (which is the best in a long time) were to be allowed, then I believe the owner should be responsible.
As said before, integrated into the bot should be the name and IP of the owner, so then it is easy to track that person down.
Imo, the owner should be responsible. When they buy the bot they know the rules and consequences of using it, and if broken shall result in a reasonable punishment.