but as to the last question, if you have concrete evidence that someone is making credible threats to you, you should take that seriously and contact LE about what can be done, including a restrainig order.

Your physical safety has got to come first.

I'm not a lawyer, but I do have experience with computers and some daily legal aspects thereof.

The first problem you had was not privatizing your registration to begin with. I do this for legitimate domains I register just because I don't want my personal information floating around more than needed. I'm assuming you learned your lesson and don't try to skimp on this feature in the future.

I'm not sure how much legal power ICANN has. Their function is, essentially, just to keep an accurate database of such things. The problem is that now you've exposed yourself (a little) to whatever corporate action they can take with regard to that domain. ICANN is usually not an entity you will ever hear from. I've never heard of ICANN reporting anyone for a criminal violation, there needing to be a subpoena to ICANN directly, etc. If anyone has to be subpoenaed, it would be your registrar. Neither of them is in the business of law enforcement. In fact, it's bad for business. If anti-American and semi-legal militia organizations can register domain names so can you.

Now, let's go back to your worry: can your personal records/info you registered for the domain be released? You're correct that would only be done by subpoena to a specific party. If this is a stalker, it doesn't look like they'd have a case for a criminal complaint that would result in the need for such thing. Civil complaint? Well, in order for a lawsuit to go forward you in fact have to be served. A sheriff or process server has to come to you, and then you lawyer up and have plenty of opportunities to make things go away. If this stalker is just a misfit that doesn't know your personal information (your real name, residence), that makes this whole thing a lot harder. If they do know all this information, what purpose is there to be had from obtaining the actual contact and other information behind your domain registration?

To address a few technicalities, this would likely never come to being subpoenaed (if you are a party to a lawsuit, this is information you readily have access to and would have to provide, if it has any relation to the matter at hand, to the other party within discovery). And, you also have to think long and hard about what claim/cause of action (this is the civil equivalent of charges) need to be brought in order for such information to be at all relevant or lead to relevant information (for the given problem, the website would have to have some relation to the complaint that was brought). Basically, what I'm trying to get at is that anyone that has enough information about you to file a lawsuit would already know enough to render whatever information they learn about your domain moot/redundant.