This sounds similar to an issue we had recently. What we found to be happening was that the customer was using the Share Wishlist functionality as a spam service.
The customer would create an account, add an item to their wishlist, and then choose to share the Wishlist. As there wasn't any limit on the number of email addresses the customer could enter, they were pasting in thousands. The customer would then enter their spam message in the message field and then send these, essentially using our website as a spam bot.
Our solution was to remove the Share Wishlist functionality. If you wish to keep the Share Wishlist functionality you could add a limit to the number of email addresses the customer is permitted to share their Wishlist with.