> The receiver of the C&D should see a lawyer

yeah, just get a lawyer! not like that's an expensive thing to do as an individual, private, open-source dev, at the risk of being stuck in a legal dispute versus a corporation with deep(er) pockets.

> Somebody at their company saw a fork with their own company name on it, impersonating their own client auth code, and sent a C&D.

I would doubt this is the case, Orca Slicer exists since 2022 and is very popular. This is not a "somebody just noticed a thing" situation.