Clearly, your bank may have some liability for paying forgeries of your own customer's signature. However, you have at least a partial defense to liability if you can get the business owner to say that the employee ever forged her signature with her permission. (Look for a forgery by the employee on a check that was used to pay a business debt.) That's called "ratification" and your bank would not be able to tell the difference between an "approved" and "unapproved" forgery.
The second issue would be exactly how long she waited to inform your bank of the forgeries after they first appeared on her statement. In general, she would have a year, but it is likely that the language in your agreement shortened that time frame dramatically.
In any case, you need to talk to your bank's attorney. Coming here to get insight into a situation may be helpful, but you will not be able to protect your institution adequately if you are only attempting to repeat the observations that others offer you here.