Hacker News Reader

It might be a honeypot for exactly that purpose aswell

What would it lead them to other than the user's VPN ip/Tor exit node?

It might lead to: someone who wasn't careful enough to use one of those options, identifying metadata in the file, etc