It's all good. Lessons have been learned and solutions are being put in place.
Two things have already changed:
The wording in the registration process now makes it 100% clear that the email address used to confirm the account needs to be recorded for situations like this.
A bot has been created by @arcange to send wallet messages to anyone who receives a wallet message from a known scammer.
Thanks for your support :)