Pretty aggressive opener. Is that really necessary?
"There's no harm in letting them know they've retained one"
It will, for sure, trigger an internal discussion, and maybe some defensive moves like trolling logs or making a copy of his work PC drive. For example, what do you suppose the chances are that the OP navigated to his GitHub repo from a work PC?
How is advising caution in this situation "nonsense"? I would weigh the consequences of telling them I had a lawyer, and evaluate anything else I should probably do before telling them.