Report and hide user to start. Report for your friend (follows are important here)

Most client apps hide messages, notifications, etc with 5+ reports from follows. If they fail, let them know.

Relays will delete msgs if reports are valid. You can stop using the relay of the attacker if relay operators don't act.

Many relays are in jurisdictions that require them to report to the police on certain threat levels.

In time, I am sure intelligence depts will be downloading reports from relays in realtime if they don't already do.