If he was not receiving funds, why even host it for these users? Make it easy for people to self host it on their AWS, PaaS, etc. and then you’re not directly involved in the use of that software. If software was really the issue, how could Kali Linux exist?
In order for it to work, you need as many people tumbling the same exact amount of crypto. If it’s self hosted, it wouldn’t be difficult to figure out that if two or three transactions went in, you only need to track the two or three transactions that come out.
