What to do with someone that cheated their way through university and a PhD program?
He literally had someone else take the exams for him


If you wanted to speak out, that was really the right time, not so many years later when damage is done and every accusation is virtually unprovable.


  His doctoral thesis was weak and the defense round wasn't difficult.


There are many weak PhD theses around, and it's up to the universities and to the defense committees to decide which level of weakness is acceptable before rejecting a candidate (gosh, if we were to object to any "weak" degree...).


  Do I tell his employer? Do I tell the university? Do I let it go?


You let it go because, as you said, you've nothing to prove your accusations (and the university would have no interest in undertaking an investigation after such a long time without any evidence to start with). And he is now in industry, and it's up to his employer to decide whether to promote or demote him according to his work performance and to decide whether the PhD title is just a vacuous document in his hands.

Different is the case where, for instance, you can prove that a student cheated by plagiarising other works. Here, there is evidence that can be used to revoke a degree, as it happened in some cases.