There are no users in bitcoin - only addressees and I'm not sure that all double spend attempts are malicious. Isn't it possible to attempt double spend during blockchain fork under "normal usage" - not willingly?