This happened to Microsoft recently with their Windows 7 USB/DVD Download tool: http://wudt.codeplex.com/ . They (apparently via a 3rd party development house) used GPL code from the ImageMaster project without releasing any of their sources. MS did the right thing in the end and released the code, but like you say, it shouldn’t happen in the first place. You should hold contractors to the same level of code quality that you’d expect from your employees.