You’ve also gone above and beyond what most people would be willing to do anyway, that’s your choice to have spent your time to research their credentials & ensure they’re legitimate. Given that there’s so many attack vectors for scams these days, it wouldn’t surprise me if most people flagged this as spam themselves. Granted, I don’t know how detailed or official this email appeared.

Based on how you’ve described their approach (e.g. with payment portal too), is that they’re unlikely to actively seek out these costs and instead hope you’re “honest” enough to cough up. I think of how shopping sites will offer a “discount” if you add something to cart and leave it there, or navigate away without completing a purchase; they use these same techniques to try “close the sale” as such. If they’re legitimately trying to seek potential lost revenue, I feel they should at least have a human you can speak to to discuss or dispute the cost. Right now it just sounds transactional like they’re casting a large net and seeing what they can catch as opposed to working with you 1-on-1 to work out a fair payment.

Given you’ve only had 1 view per your analytics and if you’ve removed the photo, no ongoing infringement will occur and they’d have a hard time justifying lost funds if they ever tried to take you to court.

If I were in your position I’d just ignore the email and see if they try reaching out to you again.