As the owner of the mixer seems to lack skills to properly configure the mixer, I doub't he is having skills to trace me. I plan to mix the coins elsewhere after I get it.
There might a chance that could they trace you if they figure out a massive loss of their profit because of the loopholes you've said. There's an agency that can able to trace and track down Bitcoin transactions or any transactions related to blockchain. But I think if that is worth it for them to recover their loss and pay for that cost.
It seems this case belonged to cybercriminals and I think your friend might be at risk because that is illegal, they might call him a theft or hacker.
However, it is impossible if the owner of the mixer service won't be noticed about this. I don't know how their business work but I think they had a full audit, might be weekly or monthly.