I’m pretty sure if I worked for the IRS I would be visiting that company immediately and making sure they are reporting everything properly.

Those users will be doxxed anyway, they should just keep the money since they are on the hook for it anyway now.