First of all, breathe. OK ...
Now, ask them for the copyright registration information. If they didn't register it, you have a lot more going for you, regardless of the situation over any possible infringement. A copyright has to be registered in order to bring a lawsuit. See: http://www.copyright.gov/help/faq/fa....html#register
Can you copyright HTML and CSS code? Yes. Code renders things in unique, specific ways, and that makes creative use of code and as such can be copyrighted. This is most obvious when the formatting of the actual code is exactly the same (indents, spacing and such).
Code:
a:link, body_alink
{
color: #3300CC;
}
a:visited, body_avisited
{
color: #000099;
}
a:hover, a:active, body_ahover
{
color: #9900FF;
}
is different from
Code:
a:link, body_alink {
color: #3300CC;
}
a:visited, body_avisited {
color: #000099;
}
a:hover, a:active, body_ahover {
color: #9900FF;
}
even though they do the exact same thing. If two different sites have the same text and formatting it's easier to convince others that the code was copied. Not that one can't if the formatting is different, but it's harder if it is.
Your best defense if they have registered a copyright is to find the site you downloaded the template from. Did you try searching for the name of the archive? If you can find it again, you have evidence that you used it in good faith.
Do you have assets that could be seized to fulfill a judgment? If you don't, then they have little reason to sue as they won't be able to collect.
Keep in mind that attorneys will attempt to get you to settle out of fear. Several months ago I got a cease and desist letter about some postings on a forum I run, telling me that one person on the forum was sued for defamation and lost and they demanded that I remove all objectionable posting by both parties in the suit or that I would be liable for damages as well. I responded with a note that as an "internet service provider" as defined by law that forum operators are not responsible for what others post on their sites. I also mentioned that there were one and a half million postings and that even if I wanted to, reviewing them all would be a physical impossibility and even then I still would have no idea which ones they found objectionable and which ones not. I told them that I wouldn't be intimidated by their threats, but if they would furnish the URLs of the posts in question I would review them and take appropriate action. Nothing else has happened since. Moral: don't be intimidated by threats (don't dismiss them out of hand either, but keep a level head).
Talk to a lawyer. Don't take legal advice from anyone who isn't a lawyer (including me). If you haven't talked to you client about this, do so. If your story is accurate, then you have nothing to fear from talking to them and explain to them what has happened. They may be able to help you with this (although their specialty is different, it's all law). Maybe offer to make whatever changes are necessary to the site and maybe refund the fee or something similar in exchange for basic advice and sending back a letter could be worked out and then maybe you won't be out any money and it will be over. If they can't help you. ask them to recommend someone who could do so. Also check for local free lawyer consultations that you could avail yourself of.
For everything copyright: http://www.copyright.gov/