They should be - but they should also have some leniency from lacking clear intent. The people who spread this “hack” obviously knew it was check fraud and some of these folks may have known it… but some others may just be rubes. Obviously it’ll come down to the actual trials but it’d be good to let most of these folks off with just returning the stolen funds with no additional punishment. There isn’t really any deterrence value from punishing people who knew no better for exploiting a now closed loop hole - there’s no possibility to copy cat the check fraud now.
I’d also love to see the FTC go after JP Morgan for such a fucking large security hole - this hack was only possible because of their negligence.