I don't think he has no choice but to return it just like what you have said they know his address and name. But I think it's the exchange's fault and not the user the good thing to do is to maybe give the user a reward for returning the Bitcoin but if the buyer becomes greedy well I'm not sure what will be the PDAX's move after that.
What if they have their address and name? Is this exchange a part of a mob clan or something?!
Of course they could do something - sue with the exchange if there is nothing in the TOS about order price deviation and cancelation! This is not his fault. If this was a DEX, you couldn't do a thing!