niche engineering software only knows if the software manages to communicate with server (something crackers would take care off), most of the time when you get a letter like that its because you torrented something, opened it and it was fake, basically something they use to try and get rid of pirates even though the software/video is fake.
A lot of niche software companies do not bother trying to fight the pirates, when people cannot afford to buy your software its not going to help trying to go after them, so if its a company from the US, its something they would already know but any company that knows you use their software to make money but not pay for it will obviously go after you, but this rarely happens and usually caught when audited.
So just audit your own company to show that such claim is not true. If you did find the software, just claim that the install was not authorised and removed (you can prove this if your company doesnt use said CAD to make products, by showing what you use for your products).
Most of the time these letters are scams/fakes, basically legit company that release fake stuff to make people who want to pirate download it, its easy and cheap to have thousands of seeds for it and torrents let you track who your seeds and peers too so when you try and search for their product, the fake pops up in a favourable way.
The reason i say this is because only 1 PC was said to use it when it seems his company has many PCs, so this seems to me like the case of an unauthorised install or fake for tracking. This is one reason for tight control over your network and PCs and the only way if this is a legit claim is to have a proper audit that shows otherwise (including that you never touch their product when you make yours) and that such a thing was unauthorised and to thank them of exposing a vulnerability in your network.
Thanks for the insight. But in this case, the one Pc that they pin point did have the software installed no torrenting of the software ever happened. One post here did say the software might contain backdoor. The software was cracked version downloaded off internet. The cracked method involved replacement of "host_id " and replacement of a program file etc.
The lawyer letter claimed that we are using that software and no record from the USA software company that we had ever purchased it.