If I was DHH I would have replaced the images with something else. It is always entertaining what you can do to someone's site if they are foolish enough to pull images off your server. Or they could have blocked the hotlinking of the image.
What if Curebit had an important demo/presentation that was botched as a result of this? I think the response should be tailored to provide them with a learning opportunity rather than to hurt their startup. A private naming/shaming like betageek suggested would probably do the trick.
