if the letters received contain a paypal usename/email
forward them ( long / full headers ) to spoof@paypal.com
they can shut his account down there too ...