I found a Vulnerability. They found a Lawyer

Back in the day there was a word for those kind of threats: "Cartooneys". Usually they were sent on behalf of spammers toward people who were trying to stop spam, and often the "attorneys" involved weren't real. (Other times they were real but absurd.)

Here's an example:

https://web.archive.org/web/20160422020100/http://bolen.somebastard.net/

Sometimes I'm happy to see that things haven't changed... I'd have been happier for this one to have changed. Good job standing up.

I would have gone after both the insurance company and its law firm. That behavior is unacceptable, and those responsible needs to be held to account. The only way to "fix" this kind of behavior is to make it terribly, terribly expensive to behave in this manner, which means you sue them for the total social cost of their behavior, plus 3x damages.