I don't know. It depends on your jurisdiction. However this is an automated tool and most detected images will be false positives. Requirements for reporting are necessary for validated CSAM but IANAL.
The IP is not visible from the object storage. I do store the OS path, so one would need to trace that to the pict-rs ID, and from the to the lemmy post id, and from there to the user.
Note that the script I posted is not transmitting the images to the AI Horde.
Also keep in mind this tool is fully automated and catches a lot of false positives (due to the nature of the scan, it couldn't be otherwise). So one could argue it's a generic filtering operation, not an explicit knowledge of CSAM hosting. But IANAL of course.
This is unlike cloudflare or other services which compare with known CSAM.
EDIT: That is to mean, if you use this tool to forward these images to the govt, they are going to come after you for spamming them with garbage