Perhaps look for legal representation? I moved off GoDaddy when that big migration to Namecheap happened and have avoided them since. There was one domain that I'd forgotten to move and tried to transfer it a few months ago, which they had some bizarre 90 days "lock" on. Anyway, it wasn't very important so I just let it go rather than deal with Godaddy.
3. Talk to law enforcement or ask your customers to do so (not sure who has the better standing to get something done?). Even if they don't do anything, might help get GoDaddy to take it seriously?
You can probably get the domain using WIPO. See the UDRP.
http://www.wipo.int/amc/en/domains/guide/