I would do a DCMA take down notice against the web host and send it to whoever funded him as well. He did not pay in full. He not only stole the code but committed credit card fraud. If he has a parole officer I would try to find out.