Lessons Learnt after getting robbed off $11,000 in 17 days (medium.com)

The grammar in this makes it nigh unreadable...

I'm trying to parse exactly what happened here. The way I understand it is that forks of private repos stay private. So did the contractor fork, clone, and then push it to a separate public repo? That has lawsuit written all over it...