The user could not prove his identity when asked. We have to assume he sent in fake documents.
So you asked for documents, and when he reluctantly provides them -- you dismiss them as fake, because he didn't provide them immediately?
Can I ask what is the real problem here. You're upset he used your service for mixing purpose? And you feel that taking thousands of his money is justifiable punishment?
I'll be honest, if there's some police investigation going on about the funds or something of the sort -- I'll be a bit sympathetic to you holding the money. But just taking someone's coins because you feel like it is really shocking.
It does worry me a bit that they'd do something like this just from a hunch or feeling. I'm pretty sure they can't prove that the funds are bad or illegal, probably it is as you say, they are mad that he used their site as a mixer. Probably not the best decision made by the user either but it is what it is. Give him an IP ban and be done with it, stealing users funds is a big no no in this industry. Especially if you want to grow bigger and increase your userbase.