tl;dr: I emailed some dude with the same name as a guy in the email. He replied that he didn't know what I was talking about.
They are innocent until proven guilt, but from purely practical perspective it makes little difference whether they deny it. Doubt has been cast on the code & the only way this is gonna go away is if someone reputable checks it.