The bank of first deposit made a "presentment warranty" to you under your state's Uniform Commercial Code. The payee is claiming they did not receive the proceeds of the check so the claim against the BOFD is that they breeched their presentment warranty.
The payee should complete an affidavit of forged/missing endorsement which states that they neither endorsed nor received benefit from the check. Make sure whoever signs the affidavit also provides evidence that they are authorized to sign on behalf of the payee. That affidavit along with a photo in lieu copy of the check should be sent without entry to the bank of first deposit demanding payment in the form of a cashier's check or wire transfer for breach of the presentment warranty under the terms of your state's uniform commercial code.
Since this is a legal matter between, the payee, your customer, your bank, and the BOFD, if you are not sure how to proceed, you should be contacting your legal counsel familiar with state law.
For most states, the statute of limitations is three years for endorsement claims.
As far as liability. Your customer is liable to the payee to pay their taxes. You are liable to your customer for honoring a check with an invalid endorsement. The BOFD is liable to you for breach of presentment warranty, and the crook is liable to the BOFD. Of course, the UCC only assigns liability, it doesn't force anyone to pay anyone else. If someone in the chain refuses to satisfy their liability, any of the parties can sue the other seeking restitution from the party who is liable to them.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com