I've had this happen as a commissioner before. Sometimes, you just miss one. Since I had made a mistake, I alerted the owner and sent a ticket to admin to have the illegal player removed from the owner's roster and replaced with the nearest legal statistical/salary equivalent. I did not leave it up to the owner to do this themselves. As commissioner I wanted to be sure the change was requested and know when it was resolved. The owner agreed to this. I also, for the sake of fairness, alerted the league of what had happened and the general response was that replacing the player without forcing forfeiture of any prior games in which he may have appeared was acceptable. The owner simply stopped using the illegal player until he was replaced by admin, which took only a few cycles and had no lasting impact.
Had the owner continued to use the illegal player after being alerted and agreeing to the change, I would have probably request admin forfeit any wins that may have occurred with the illegal player appearing in the game. Thankfully, in this scenario it never came to that.