Wow, so much bad advice in this thread. All from sig spammers, so that's to be expected. The legal consequences of spending coins which do not belong to you is that you're stealing them. If the owner of the coins can track you down (which is likely, since they can probably determine which exchange the coins were sent to, and the exchange will reveal your identity in response to a court order), you may be arrested and/or sued. You must contact the exchange and inform them of the error, so that they may attempt to identify the sender and return the coins. Depending on your jurisdiction you may be allowed to keep the coins if the owner cannot be found, but only if you have made a good faith effort to find them.

what you suggest is correct, if you contact the exchange and if are not able to find the user who sent they may also try to block you address and keep the bitcoin with them, so it is better to withdraw it in your other wallet address and then try to contact your wallet support and before giving it back get enough proof because anyone come and tell that the bitcoins belong to him with fake proofs .

On what site? Can you provide a transaction id for the deposit? There are probably no legal consequences of spending the Bitcoin, but just to be safe, you should probably contact the site's support.