Email Account Security: Hacking a phisher

Claiming that the authorities in Brazil would not act is a massive understatement. Granted.

But the OP hacked someone's account. And that's also a crime.

From victim, the OP could very well end up in the other side of the system, being accused of hacking into someone else's accounts. And to make matters worse, because those services are hosted in the US, then Tom could be prosecuted there and very likely being convicted.

Never take the law into your own hands. It's not worth the risk of an eventual table turning.