I'd guess nothing, like just about everyone else here.

Report the incident to people with authority to act on it. Law Enforcement, his ISP, his data provider... anyone really, who has a legal right to stop the behavior.

In my experience, you've just proposed doing nothing.

And if you have good reason to conclude nobody is going to do anything? (Law enforcement has 'real crimes', the ISP is effectively bought off, nobody else cares.)