We have an open source project and suspect one contributor has submitted code that is not their own and is under a closed source copyright.
We know we have to remove the code. Also I assume anyone that has examined the tainted code cannot contribute a new implementation for that feature.
Are there any other steps we should take?
Sadly, there is little you can do. I believe you can argue that you accepted the code in good faith, and avoid the worst. Try to collect and organize any evidence of the affair (emails, commit identifiers, ...). Keep a copy of the current version control system contents around.
To replace the tainted code, you can see if you can set different objectives (more general, utmost performance, more portable) or use other techniques (use hashing instead of trees for searching, ...). Such differences should make the replacement different enough to avoid accusations of copying.
You might also have to go into the history in your version control system to erase the copied code. But before going to any great lengths, consult with a lawyer (or perhaps ask around at Law.SE, but check first if such a question is on-topic there).
As @vonbrand suggests, try to make a separate clean room implementation of the said source-code and then get rid of it. The ideal way is to give the new implementation task to a new member who doesn't know anything about the tainted code and just instruct him/her with the business-logic that needs implemented in the said module.
