I wound up calling this guy. The number listed was his home number but his wife kindly gave me his work number. He sounded pretty confused when I talked to him, so I just recommended that he contact his local FBI office and complain that someone was using his name for fraudulent purposes. At the time, there was no telling if he was lying or not. I figured recommending the cops would work either way.
I later got email from the sysadmin at one of the hosts associated with the spam, who said they’d found the guy responsible for the spam. Didn’t say who it was, which is OK with me.
Today, Greg pointed out this page, on which nandi@bonbon.net says:
We are a new online bank. We need someone who can make us a script which supports fully automated banking (credit card deposits, internal money
transfers, wire transfer requests, etc.). We are willing to pay big cash for
the program.
Alas, Justin Young confirmed that nandi@bonbon.net was his email address when I talked to him on the phone. So I’m thinking he’s responsible after all. Poor guy. I’m glad I got to help wield the hammer.