Have you checked to see if the ip he used to login to your site is the same as the one from his email. He may be using a static IP so it's worth a look.
I had a guy email me saying his brother used his CC without consent to sign up so I said no problem send me an affidavit that your brother committed fraud so I can hand it to the police as well as your bank and I will refund you. That was 2 weeks ago and haven't heard a word from him
