What's wrong with what he suggested? The only active measure he proposed is telling the guy's bosses. Surely that's appropriate for a mistake. The rest is just stuff to keep in mind in the event that it turns out not to be a mistake.