The bitcoins are not kept securely in our wallets.  The private keys are kept securely in a MySQL database on offsite nodes (which nobody knows the location or IP address of, not that either of those would help).  We never store the bitcoins.  As soon as we see a transaction, we send it off to the forwarded address nearly immediately.

There is no way we can regulate illegal vs. legal actions.  Anyone can prove they are the legal owner of a private key as soon as they have the private key.  This is just one possible use of our website.  While we don't agree that it should be used for this, someone else might choose to do so.  Bitcoin forwarding itself is not illegal by any meaning of the law, and therefore nothing we are doing is illegal.  It is the theif who is doing something illegal (known as stealing).  Is a person at Walmart who accepts stolen money (without knowing that it's stolen) doing something illegal?