The user could not prove his identity when asked. We have to assume he sent in fake documents.
So you asked for documents, and when he reluctantly provides them -- you dismiss them as fake, because he didn't provide them immediately?
Can I ask what is the real problem here. You're upset he used your service for mixing purpose? And you feel that taking thousands of his money is justifiable punishment?
I'll be honest, if there's some police investigation going on about the funds or something of the sort -- I'll be a bit sympathetic to you holding the money. But just taking someone's coins because you feel like it is really shocking.