I've tagged the account but have you reported the PM to an admin?
The first thing I did was report the message to the Admins. No response back from them but I'm not really expecting one.
I've also posted here (next time I'll include user profile in the OP) and posted to the forum thread that was used as the trojan horse to let them know that they've been targeted as the bait. Finally, I just left the account negative trust...not that it matters, but at least it's on the record.
I'd still do a full scan of your system to be on the safe side. You never know.
Can you share tips on how to do this?