ICANN has adopted the UDRP. WIPO handles the cases.
Godaddy isn't going to do anything unless they agree it violates their terms of service... and it sounds like they don't.
Legal options? I assume you don't even know where the squatter is.
About the only other thing you can do is put up a notice and advise your customers about phishing attempts.
(Edit: maybe you can try convincing Godaddy by pointing out specifically how it violates their ToS and why you would win the WIPO case. Also sending it to their lawyers address would get you more attention.)
