"Send to this email your service IP after sending the bitcoins"
So they don't have any way of connecting the ransom payment with the service? The obvious first step for an admin would be to send the email and hope to profit from someone else's payment.
Biting the hand that feeds IT
