I have been thinking about this, and it is MY opinion that the best way is to remove the whole discussion AND kill the users account.
Even if we do a standard reply, it leaves the discussion up where crawlers can find them, bringing MORE scum out of the woodwork looking for hacks.
I would (if I were king) change the “report as spam” to a simple “report abuse”. A hack request gets tagged and pulled, without leaving a trace.
How is THAT for a solution? 😀