This should not work that way. He legally won every single penny with them. That's his money. This will encourage other casinos to bring an end like this of big winnings and settle with only the deposit.
TBH I don't really care about any other stance in this case given the lack of information. I am only sure of the following: 1) The deposit is the user's. 2) The deposit can be returned to the originating address. There is no reason to delay the return of the deposit due to any potential "fraud".
Technically speaking if the deposit is valid, it implies the case that the winnings also are. That's what I said in an older post, they shouldn't just send back the deposit to the initial address used, just send the winnings as well. Regardless if they claim the account is in the wrong hands, the simple solution remains the same. Honestly any excuse is just a reason to further delay the payment in hopes of it never being done.
No, that is wrong. There are certainly cases in which the implication does not hold true, e.g. if the player abused a bug in order to win the game. Not to say that this was the case here, but the implication does not hold. They should have returned the deposit ages ago, then handle the dispute but only regarding the winnings, which is what would have been far more acceptable to me.