Suspending his account doesn't make any sense. He could easily sign up with another email account. Set up a new set of keys on another computer and he's back at it. GH should be working with him instead... he obviously knows what he's doing.
Working with him to do what? He pissed about a little with WebInspector, it doesn't make him a security consultant
He threatened to do more damage to your site, why wouldn't you suspend someone like that?