The terms for the bonus were very unclear:
[...]
Bonus can only be claimed once
[...]
Is that once per account? Or once per person? Or once per computer? Or once per household? Or once per IP address? Or something else?
You said "bonus can only be claimed once", and despite me asking twice for clarification as to what that was meant to mean you never provided the requested clarification.
I think the most obvious interpretation would be "once per account", since the site wouldn't let me claim twice on the same account, but would let me claim twice on the same computer, from the same household. I don't think it's fair to withhold funds from players who misinterpreted your incredibly vague terms.
It's also very rude of you to call this player a scammer. He wasn't scamming you. He was playing within the stated rules. If you offer stupid exploitable bonuses please don't blame anyone but yourself when people inevitably try to exploit them. Promising a bonus and then refusing to pay it makes you the scammer, not the people trying to claim the bonus.
Which bonus are you referring to exactly? The 100x roll-over deposit bonus?
I think most sites in the past don't really care how many times you take advance of this deposit bonus but its highly unlikely that someone can actually be able to roll-over that much and still keep their balance non-negative.
I have no idea exactly what happened, but the guy was using a VPN and maybe some other guy used the exact same VPN and tried to do something illegal. Hence why you need to becareful with VPNs.