I appreciate the advice everyone. Of course I don't have to do anything at all, I can just forget what I have learned and worry about my own store. But that doesn't sit right with me. Might be time to draft an anonymous letter.
And has it occurred to anyone that a person's anonymity on a public bulletin board is not absolute? There are ways to identify posters through their ISPs, or by subpoenaing a board's registration records.
I weighed up the risks before posting this and decided they were acceptable.