File a complaint as others suggested and also let the guy know you that you filed a complaint (even if you didn’t), so that he will be careful before using them for anything wrongful purposes.
Also, let your know school know about this and tell them you are planning on filing a cybercrime complaint against this, they tend to act quickly when they see school’s rep at stake.