First of all copyright rules only matter if the copyright holder chooses to complain. Such complaints usually don't happen unless there is another issue between employee and employer, or if the employer thinks they have something to gain by complaining. So, for instance, if an employee in NY, NY has worked in personal time on a startup, the employer may take ownership of the startup. However there is little to be gained, and lots of bad publicity to be lost from getting in a legal battle with an open source project.

Secondly even if such a complaint happens, demonstrating that you had cause to believe you were operating in good faith is a valid defense against past infringements. You will then be able to satisfy the court by working to stop future infringements. Which means that you have to take the offending code out of your code base. (Source control makes tracking down this kind of thing fairly easy.) To borrow your car analogy, if the car was stolen years ago but you bought it in good faith, you're not going to be successfully sued now for having driven it in the past. All that's going to happen is that you'll lose the car, and won't be allowed to drive it in the future.

So realistically if an open source project accepts possibly questionable code there is little risk of anything bad happening to them, and if something does happen, it probably won't be a big deal.

Finally be aware that law in this area varies wildly. In New York, ownership defaults to the employer. In California, ownership not only defaults to the employee, but by law you cannot sign that right away. (I've long maintained that this is one of the reasons that there are more startups in California than New York.) I would expect that there is a similarly wide variation in Europe about the work for hire doctrine.

For the record, since this is turning out to be a good thread on it, Amazon.com is one of the companies with a draconian employment agreement which says that not only work you do on your time but any ideas you have at any time belong to them. We knew that this wouldn't fly in California but no one knew what would happen in Washington and at the time (years ago) there was little or no local legal precedence on the issue.

AFAI can google the copyright issue has been harmonized within the EU. And most non EU neighbours are somehow associated and adopt regulations from Brussels sooner or later...

Can you post links referencing that? If so, then I'd be interested in reading them.

Also note that copyright harmonization may not mean what you expect. Copyright is fairly well harmonized between NY and CA. Both states agree on what it means to be a work for hire, and that whether a specific work is for hire depends on the employee's local state law and your employment contract. Both agree that the penalties for copyright infringement are as is laid out by the US federal government. Courts from one state will take into account precedent from the other. You therefore cannot get a NY court to enforce a copyright claim against a CA employee when CA law says that is not a work for hire, and a CA court will not protect you against copyright trouble stemming from someone from NY improperly contributing code that is a work for hire under NY state law. But this harmonization notwithstanding, CA residents and NY residents live under very different copyright rules.

In short in this case harmonization means that the legal fiction of copyright ownership is applied consistently to any specific copyright, but the results are not consistent for different people.

My understanding of copyright harmonization in the EU is that it is similar to what exists within the USA. There is agreement on the basics of copyright doctrine, and the basics of how those rules are to be enforced. EU countries have signed specific treaties, sometimes the EU has clarified those treaties, and then individual countries have passed local laws to implement those treaties. Those treaties include terms for recognizing copyrights from other countries covered by the same treaties. But nothing stops there from being differing rules on who owns a copyright.

In fact the USA is signatory to many of those treaties. And as a result, I would fully expect that a German court would be willing to enforce a copyright infringement case from a NY employer on the basis of that work having been a work for hire even though done on personal time, while the same court will refuse to enforce a similar case from a CA employer on the basis of the fact that the employer cannot demonstrate that they own copyright.