The answer is #1. Also known as, don't feed the trolls. Anything else is giving too much energy to it. If any overt action is taken without perfect information (or near perfect), then you or I (e.g.) could someday be in the cross hairs for far less clear reasons.

Note, I replied to the person noting they "revealed" credentials on a free database site; but I suspected then and do now that this was just a ploy to gets someone from here to try to test the credentials. So the other side to #1 is, don't take the bait.