Change the user his password and email address
After that you can delete the spam posts.
I have no idea how the can get to the users accounts but I had the same yesterday on one of my boards.
Any ideas, I have had a few accounts over 10 years old posting spam, but they are proper users just not been on for that length of time.
I was hacked many years ago, I'm guessing my date has been out there since the hack?