Being sloppy with licensing is a good way to expose your company to legal risk, so you need to be straightforward with the facts to your management and get this cleared up. Talking to the lead in question is a good first step. Perhaps permission had been properly obtained, in which case it should be documented as such (e.g. in comments), otherwise the original author needs to be contacted. The lead needs to take responsibility here - that's why he's a lead.
Documenting where the code came from (assuming it's legit) is more than just good legal practice. It's also good engineering practice. If there are bugs in that area, a future maintainer can go back to that forum to report them, or look for solutions, for example.
A good lead should also know better than to play lawyer, but everyone has a bad day, and most people are basically decent and act in good faith. Start the conversation assuming that nobody had bad intentions and it should go fine.