If you can't find the user specificaly, make the ISP *want* to know. Go to their upstream provider and tell them the ISP is willingly letting a mail attack propagate. When they get their service cut off, they'll care.

Bruno