Hi
often it's not so easy to detect the real source of the spammer.
I don't know in this particular situation, if the return path is really by the user account or he is a victim himself!
The risk is to report an abuse, to a guy that has no fault.
Ciao