This is a textbook case for suing for compensation and punitive damages. I hope someone opened an arbitration complaint on day one to get the wheels turning. Maybe they’ll consider reviewing https://www.icann.org/compliance/complaint (one can dream).
punitive seems like a huge stretch, damages sure.
Icann Arbitration seems like the wrong channel, those are typically used for when someone correctly technically registered the domain name, but there's a dispute from the non-owner, e.g:
1- Trademark holder registers trademark.com, malicious actor registers trademark-web.com and phishes. 2- trademark.com expires, and someone registers trademark.com and domainsquats.
This is not the case, all Icann can do is make decisions over who owns a domain. A civil court would be more appropriate for calculating and ordering compensatory damages.