What a malicious matrix homeserver admin can do