If users send 0 ETH, then the scammer gets nothing. I wouldn't immediately assume that he/she is scamming as it could probably an attempt to learn how to create and use Ethereum tokens.  We all have to start somewhere. On the other hand, if you really believe its a scam then he/she could possibly be doing it using other means (maliciously storing the user's password upon registration then attempting to use this to login to other accounts/emails, etc.).