What do we do about the customer?

Tatemori recommends the lawful response for this incident and gives you the legal basis for each option — then drafts the document if one is needed. The decision is yours; Tatemori records it and keeps the proof. Banning is scoped to your own sites and needs an identifiable customer — there is no cross-company blocklist.