I think reports are an event kind that get sent to relays like any other event. The relay operators can review the reports and decide to ban the user they're directed at.