Received DMCA takedown notices for a paid font I used for my wife’s interior design website that she liked but we didn’t pay for because…I’m lazy. I was surprised to receive the DMCA (it is hosted on GitHub Pages). I ignored the emails because…I’m lazy. They (GitHub) eventually took down the repository (and site). So I swapped to another font and I don’t think my wife noticed. I think all of this was still easier tha…
Out of interest, did you rename the font prior to use? I'm curious how they found it. You can also just stick them in a font-editor and re-export "as your own font" with some minor tweaks. Not that you should, of course.
I do believe whoever the font owners are paying just scrape the HTML and CSS looking for patterns matching their font.