I don't really know what to believe here...
https://gfy.com/fucking-around-and-business-discussion/671565-running-nats-block-ip-active-hacker.html looks very much like a hack to me, which is especially targeting NATS installs / DB's
And from the feedback that RazorSharpe wrote, that banning the account in question did not help also suggests a backdoor, or some kind of undetermined access to add / restore logins.
The worst that can be done here is to cover this up, or try to shut helpful people up with threatening with lawyers etc.
Yes, it doesn't look good on NATS, but I'd rather see this fixed with support of ALL sides, as GFY does have some pretty bright / talented people on board and in the End to have the TRUST in NATS be restored / re-established than all of this being covered up / taken lightly.