I accidentally commented using the wrong account -- that's the [deleted] reply above. Here's the content:

He used the project as an example of his work in order to get an investor job four years ago. Once he got the job, he abandoned the project altogether. None of my IP is at risk -- the project is dead, he never had repo access, and his new venture is unrelated in terms of the tech.

At the time, he had assembled a 'board' of well-known startup folks. I considered emailing them at the time as you described, but feared that the drama would have a negative impact on my very young freelance career and decided not to.

I have emails containing documenting specific requirements, which he agreed to, and emails / chat logs where he says he's happy with the project and ready to go live with it. Everything but the formal contract.