So you have a 200a subpanel with a 4 wire feeder feeding another subpanel with a 3 wire feeder that was originally for the furnace only and now has 120 volt loads connected to it using the EGC as the grounded conductor. Is that right?
I'm sure that as someone able to recognize the code violation, you also recognize the hazard. You either have an uninsulated or undersized conductor being used as a current carrying conductor or you have no grounding at all.