This should not work that way. He legally won every single penny with them. That's his money. This will encourage other casinos to bring an end like this of big winnings and settle with only the deposit.
TBH I don't really care about any other stance in this case given the lack of information. I am only sure of the following: 1) The deposit is the user's. 2) The deposit can be returned to the originating address. There is no reason to delay the return of the deposit due to any potential "fraud".