The gray area here is their claim: That it was done without their approval.

If the company is the copyright holder, then the license that the code was released under was invalid from the start - regardless of it being out in the public.

Just because someone gets some Microsoft internal code and slaps an open source license on it and releases it to the public, that doesn't mean every company is now free to use the code without reprisal from Microsoft.

They're not "changing" the license - they're saying it never existed / was never valid in the first place.

Now, if they had done it officially - then yes, the best they could do was dual / re-license it. Being the copyright holder, they have the right to do this at any time. They could then stop work on the original open source licensed version and from that point on, internally, continue to develop their closed source version (minus the contributions to the open source fork).

The open source (older) version would continue to exist, separately, and continue to be free for use.

If someone has a business/product built on using nv3d and they come after them with a cease and desist / demand for money, the business in question could definitely take them to court over it and attempt discovery to find internal documents indicating whether it was truly approved or not - which would then either ratify or abolish the license once and for all.

If that source code was under github.com/microsoft for almost a year, that would be a very different story.

Once they can reasonably prove that is was done without authorization, could you personally sue the rogue employee for damages, I wonder?

Well, of course.

As I understand it you're only bound by the open source terms included with the software at the time you started using it - - basically if you modify the code you're bound to release your changes if you redistribute the software. They cannot change the version you're already using retroactively.

Was the license ever valid though, if the copyright owner didn't issue it? If I stole a car, then signed a contract giving you the car for $1, then would you be able to keep the car?

No, you'd have to give them the car, because the rightful owners are denied a car by you keeping it. But be careful, licensing doesn't fall under traditional ownership/theft rules.

Obligatory IANAL but... Pretty sure possession of stolen property isn't legal even if you paid for it.

If the deal appears to be too good then you can be charged with handling stolen goods, which is a loophole closer for people palming off stolen items to friends for almost nothing. If you pay what is considered a going rate for an item that turns out to be stolen you are most likely not breaking the law, though of course that doesn't mean the property is yours or that you would be compensated for it's removal from your ownership. Note this is relevant to UK law, no idea about other jurisdictions.