This matters why exactly? You've said it yourself, if they're from a restricted country then you return the balance. The user has proven that the originating addresses are owned by them, and that is sufficient. Here we have it, yet another delay. Just send them their money to the addresses where it came from and ban/delete them permanently. This takes very little time.