Why not just halt all payouts to the old software and only pay out to versions which are using the Authedmine.com version?
Why not do KYC on people who have a very high likelihood of using your software to violate the law?
Salon is the kind of magazine which will call (justly) for corporate responsibility in all sorts of industries, but when it comes to software makers just totally not doing the basic, easy things when it comes to respecting web security, they'll pay them.
Halting payouts to those using the old software leaves legitimate users out to dry as well - whatever they do, someone is going to be miffed. I assume there will be a point in the future when they do refuse service to all the old API endpoints, but they can't rush that.