That would be my approach too, but I was wondering if this would be enough to stay out of trouble.

Under german law, yes, notice-and-takedown is basically all you need to adhere to; if you are aware of illegal activities, you must take measures to stop them. (But unlike the DMCA for example, you are allowed to verify any notices thoroughly before taking action, you only have to listen to verified claims)