Responding to an email like that has basically no possible benefits for the person running the balloon tracking website, but it does introduce the possibility of some fool paying their lawyer to add you as a respondent in a lawsuit. Costing you many thousands of dollars at minimum in legal fees and travel even if you get the court to remove you from the case. Never respond to something like that unless your lawyer, whom you pay has instructed you to.

A person like that sending inquiries to website/API operators demanding data, ignore it. Always. Continue to ignore it until a process server actually shows up on your doorstep and serves you, in which case you know they're at least moderately serious, and then you need to engage your own counsel to deal with it.

Or maybe the sonde continued transmitting and they have data on where the guy took it which would help ID him.

Or if they'd been foolish enough to log the recovery on sondehub itself, which some of us do frequently (but not after causing property damage!).

Fair, I guess, I just can’t imagine what it’s like getting all these weird requests and demands for a hobby project. Hopefully the author is more entertained than I would be.