They should refund the people who fell for the scam. It was their responsibility to keep their mail servers safe, they failed to do so, and resulted in a monetary loss of their customers.
If it really is their fault that people fell for the scam then they should refund the people who use their platform but if the site does give warning to the people about this scam problem and still there are people fell for the scam then they don't have the responsibility to refund the scam victims. Most casinos warning gamblers to be responsible on what they do.