[Jenta]

you have to email abuse@whatever isp.com with server logs, sql data, anything that they are doing
include time and date with timezone of the incident and a description of their abusive actions

you will get an automated reply thanking you and giving you some basic info
from there its up to them...u dont get to find out what happens

if you give them the evidence properly you can be pretty sure that thier account will be suspended or a warning issued

edit: dont send them entire logs, just trim out his ips and his get commands etc