It's important to keep the tone understanding and non-judgmental. The user might not be malicious; they could just not realize the implications. I should clearly state the facts about the legal risks and security threats without being confrontational.