It's too late, he put his name and his username in his public CV, in github licenses, in his scientific publications . It took 1 minute of googling to find his real name. It's delusional to expect he can get that genie back in the bottle.
Like I said, I understand the damage has been done, but to prevent future instances (and possibly mitigate existing ones) the OP will have to take certain measures which may involve sacrificing information published under their current online persona (by deleting accounts, changing usernames etc). It should make things a little harder for online sleuths, but nevertheless not impossible to track down.
I can provide another suggestion, which is to change their real name. Depends on the OP, how far they are willing to go to undo their mistake.