What is wrong in the following algorithm for computing a hash function using RSA? I'm studying for a cryto exam and have run across this question which has stumped me.

What is wrong in the following algorithm for computing a hash function?


Take a message $M$,
generate a random private RSA key $K$.
Encrypt $M$ with $K$ and
take the first 240 bits of the result as a hash of $M$
Hash functions must be public, so if you want to use RSA as a hash function you should fix $K$. Now let $n$ be the RSA modulus and $H$ denote an RSA hash function. We have

$$H(M)=H(M+n)$$

so this function is not second preimage and collision resistant.
Also, this system is not first preimage resistant (with known public and private key):
Let $M^k=h \pmod n$ and $h_t$ denote the first $t$ bit of $h$, so $H(M)=h_{240}$.
Now suppose $e$ is the public key and $M'={h_{240}}^e \pmod n$. We have:

$$H(M')=h_{240}$$

So we found an inverse for this hash function and this is not preimage resistant.