Blockchain has proof that even you or the scammer can't change anything. If the funds are successfully sent to your hot wallet, then it is proof and you can't deny it. Very strange, I've never even seen a reputable exchange use this method.
The recovery method you requested is a waste of time for the real owner of the funds. Even people new to crypto know that blockchain verification is more credible than screenshots. Does your team not have competent resources to analyze blockchain transactions?

If you insist on generalizing claim terms like that, your problems will never go away at least refunding the user who can sign the address.