I would look for the company's lawyers and let them know the problem, they'll be professional about it and ask the IT/security department to capture incomming email from the scammer that could be used as proof for the police. You could even look for a lawyer to talk to them as a crime investigation. Pretty sure the company will take the issue in a formal way.