In the most extreme cases, they could sue for defamation and...

In the most extreme cases, they could sue for defamation and libel. It basically comes down to what's being said, how severe (and derogatory) it is, and whether they see sufficient return to spend the money on the case. And bear in mind that the case could be brought by the company, or by an individual (again, depending on what's being said), so if - for example - somebody was posting extremely slanderous statements about my company and me as the chairman, I could choose to sue on a personal basis. (Just as an example; I don't actually own or run a company.)

In short: free speech is all well and good, but you have to be prepared for the consequences. It wouldn't be that hard to get an email address out of HotCopper, and trace that back to an individual (even free email accounts: a warrant to Hotmail, Google, or Yahoo to find an IP address, followed by a warrant to the ISP to determine who the owner of the ISP account is, followed by a court directive to that individual to identify the individual in question...)