Change that user's password and check the mailq to remove any remaining spam messages, restart postfix and restart dovecot(?) to drop current logged in connections, but this depends on having an alternate way to contact the client (phone or control panel?) to update their password.
