Caller ID can be spoofed, so all you've really got at the moment is a claim--not proof.
Probably the easiest and most immediate thing to do is login to the Def and issue a "list tra sta 200" (replace 200 with the extension in question). They've even got a
Youtube on it.
Now unless the customer is doing something tricky, temporarily assigning that user a different extension number might work. You're not likely to send out the offending DID number if the associated extension doesn't exist, right?
From the residential user's end, he/she could always activate Nuisance Call Block (a code dialed immediately after hanging up from an unwanted call). Other codes (Call Trace or Call Trap) "flags" the call so that the phone company can investigate the true source of the call. The last two vertical codes are really telco tools, thus offered at no charge.