Would it be against the rules for me to (attempt to) add a scammer flag since I personally haven't dealt with the user in question?
Yes. You can only leave the weakest-type flag if you weren't harmed personally.
Just to confirm, you are not allowed to create a contract violation flag unless you were personally harmed, correct?
Correct.