I’d advise to continue the rest of the discussion on this thread as there’s no sensitive data that needs to be shared privately anymore.
Coming back to the original problem, I understand that they should not have access to the code, but we might need to follow some procedures and cannot take them down immediately. I’d advise you to file a DMCA complaint here: DMCA Takedown Policy and we can then provide them a notice. They can either revert within 24 hours after we give them a warning and if they don’t revert, we can take that website down.
However, for us to be able to give them a warning of any sort, we’d need to have a complete request from your end that could prove your ownership of the code and that they’re violating it.
I hope you understand and would allow us to proceed with this in a systematic way.