If you're seriously concerned about Identity Theft (and I would be, since being your ex-employer they have all your information, especially social security number) there are other steps you can take before going to a lawyer.
Especially since many answers and comments here are advising talking to a lawyer, and since lawyers are very rarely free, it's worth noting that you can get help by going to local police or even the FBI (if you're in the USA). It may seem like overkill now, but you don't know what may have already been done online by "fake you."
The FBI advises on their Identity Theft pages like Protecting Your Identity:
Identity theft occurs when someone becomes you. What’s the motivation for this surreptitious subrogation? Of course in most cases, it’s financial gain, but perpetrators also use false identities to get a job, to get healthcare, or to commit a different crime.
But for any of that to happen, the crook first needs to know your personal information. Your name, home address, and birth date provide a good start and are readily available in many easily searchable public databases. Your social security number, which is a more difficult identifier to steal and is also the key to unlocking your credit, is so important to an identity thief that you must go out of our way to protect it.
And their "what to do" step 3 is contact local police. It should be free too, so paying by the hour like a lawyer would charge.
Since your ex-employer is already impersonating you online, it's not unreasonable to be worried that they might want to start buying things and having the bills sent to your house under your name.
They may have already broken some laws, or could get you in big trouble if they decide to harass people online. According to this article Analysis: California's Online Impersonation Law:
As of January 1, 2011, California's first online impersonation law – SB 1411 – goes into effect, making malicious digital impersonation a misdemeanor that comes with fines up to $1000 and/or up to a year in jail.
For a long time, online impersonation was mainly thought of as identity theft, or as something done occasionally by pathetic exes or total dicks, but it happened mostly when your credit got hijacked and you found yourself the proud owner of a $5K phone bill and a receipt for swampland in Florida. This past year saw a sharp spike in a much more personal kind of impersonation: when people abuse the anonymity of the Internet to cyber-harass individuals.
Another British lawyer mentions some other problems you could have, among defamation, fraud, some interesting "privacy" issues with online communications people think are yours:
What may be more sinister is when the impersonator starts to communicate with others. Those that communicate with a faker, and share personal information, may have very serious damages claims. In one such instance a client of mine was the victim of an impersonator. The faker swapped a number of intimate messages via social media with a young girl (believing that she was communicating with my client). The girl was devastated and would, if she had chosen to sue, have been entitled to significant damages for misuse of private information.
(You didn't say what country you're in, but in general there probably are similar laws in the USA, UK, Europe...)