>> There isn't some PCI police that has a list of all their customers and will email them.

The payment processor that the competitor uses can stop processing their transactions. While I was in the PCI consulting space a few years ago, I saw many cases where small and medium sized companies ended on the credit companies black list and no payment processor would dare take their business.