The owner of the name should have said nothing as to his particular purpose of owning the name.
It is impossible for the law firm, or anybody, for that matter, to legitimately prove that he was receiving these emails in the first place. Never mind anything to do with just what he was doing with any information he might have come into.
In actuality, the liability of negligently transmitting confidential information via email lies with the sender. It's their own fault for not typing the email address in correctly.
If I mail confidential documents to 123 Somewhere Street, but write 125 Somewhere Street on the envelope by accident, and somehow the information gets released, whose fault is it? It would be mine as the sender! Does the occupant of 125 Somewhere Street then become guilty for having a "confusingly similar" street address?
Or, if my phone number is one digit off of a lawyer's direct phone line, and someone leaves a confidential message in my voicemail, whose fault is it? The person who dialed the phone! Can my phone number then be repossessed to the lawyer for being "confusingly similar"?
I say he loses the case, but that's his own fault. We as consumers have a right to own domain names. Just because a law firm likes to ask questions, doesn't mean we're under any obligation to answer them.