Did you owe him the rest of the fund? No, I don't think so.
Did he have to return the 2btc? IMO, no. It's his reward for finding a loophole and the consequence you have to pay for not screening your program thoroughly enough.
Did he deserve a type-2 flag? Again, IMO, no. A red trust maybe, but not a flag, as he didn't breach any contract. He's not a member of the test program under contract, nor your TnC --as he stated-- specifies that betting negative is not allowed.
Oh really? Based on your opinion. If you go to a shop and see no one there is even no shopkeeper. would you grab anything you want and run away? And do you think that it's your reward and you should not return it to the shopkeeper because it's his responsibility to secure and keep eye on his shop? Should shopkeepers advertise that stealing from their shop is forbidden? If he doesn't do. That's means stealing from this shop is okay. Right? If yes, then he doesn't deserve a red trust too. He deserves to be DT-1 and he should be on everyone's trust list. I was wondering how the heck people do looting from a chain shop and who are these guys? Don't they feel it's not right? I guess I found some guys like these.
Anyways, Not just did he steal 2 BTC but also he was back again and making complaints that the casino is not paying. They blocked him. He is trying to blackmail the casino. That's why we are here with an accusation after 2 years.