[StavrosK]

But it's trivial to prove that it was the attacker, they can just sign this message with the public key used for the transaction.