The spammer hit over 200 people before I deleted his account and all the private messages he's sent.
I will work on introducing more security measures to prevent this type of thing in the future. Right now security is pretty lax so I should be able to add some relatively mild security but still prevent this type of thing.