I would start to look for legal representation just in case this guy actually files a lawsuit.

But to be honest, crappy insecure site or not you went poking around and even created an extension that bypasses their (crappy) business model.

You made some poor decisions time to deal with the consequences, depending on the state/country he might or might not have a good claim against you.

Seek legal representation