To me, it also sounds like an ongoing harassment situation. In these cases, you should report, ignore, and never engage them back or whisper etc. The exploit sounds like another issue and I agree the hacks email is appropriate. There is a ticket option specifically for harassment. This may be useful as well: