I have been in the same situation a few times, even at the company I still work at. The truth is, it's in no one's best interest to drag this out. They'll do a

I have been in the same situation a few times, even at the company I still work at. The truth is, it's in no one's best interest to drag this out. They'll do an investigation and only if they have solid evidence will anything come of it. In my case, I did nothing wrong and there was no evidence. Someone accused me of something I didn't do or coincidence(s) led to me being investigated (common in the area I work, actually). Nothing came of it, because nothing happened on my end. However, it was a nerve-racking experience. Especially, because you never know if something is an accident or mistakenly evaluated. In a case I'll share, we used a ruby on rails scaffold to create a web app. Unfortunately, it had a mailer in there and looked like we could send emails out. It wasn't active and all generic code "hello world", but you can see how people freaked out. Luckily, those investigating dug into the code and evaluated it, realizing nothing was connected. In any case, if you did nothing, I'd put your odds at 99.9% chance nothing happens. In the 0.1% chance the company does something, they'll have the burden of proof and their customers will find out. Accusations do not prove guilt. The company would likely be more harmfully impacted than you will and you'll be able to provide a defense to the public record.