IMHO the response from Microsoft was fine. They admitted the mistake and taken the bot offline. What else should they do? What I find strange is that nobody criticizes twitter for not doing anything... I think Facebook would deal better with this.