The charges usually end up falling onto the last one who can't stick them onto someone else.
Like, a carrier can blame the ISP, who can blame the VPN, who can check its logs and blame an address owner, who... better keep their own logs capable of identifying someone else if they're letting random people do random stuff using that address. And a good lawyer, and will and money to fight it.