In my opinion the person who wrote it is the only one to be held responsible. As far as releasing confidential information on the receipt that identified the customer, I don’t think the restaurant said this proved that he wrote the slur. If they contended it did, they should be held liable.But releasing the information also gave the customer the opportunity to deny, with supporting evidence (the handwriting analysis), that he was not responsible for the slur.
The problem is, the news media reports the slur, the customer is judged guilty, and their reputation is ruined. It is very hard to unring a bell. That is why suing is a good answer. Punish and prevent the next hoaxer, or at lest make them think twice.
She still works for the restaurant AFTER they found she posted the receipt in violation of company policy. That makes the restaurant complicit in slandering the customer. Let’s go to trial and sort it out.
Except they could have oh so generously given the customer "the opportunity to deny" with a private phone call or letter. They didn't, which brings the phrase "malicious intent" to mind.