IMO, this is potentially quite a serious matter. At the very least, it should make any AdSense publisher nervous, because at any time, they could be asked to refund money they previously made. Furthermore, it raises some questions about Google's anti-click fraud measures:
- Did they learn new information that caused them to reclassify the clicks? If so, what was it, and why did they reclassify?
- Is it legal for the statute of limitations for click fraud remediation to be arbitrary? How much revenue is an AdSense publisher potentially liable for?
- Would a professional audit uphold these results, or reverse them? What would happen if this was applied to all clicks?
Even if the publisher actually did participate in the fraudulent activity, these are still valid questions. Quite easily, a publisher's computer could be compromised to perpetrate click fraud, unbeknownst to the publisher, even if the publisher's computer is running antivirus or some other type of anti-malware protection. Thus, the innocent can be made to appear guilty.