I couldn't find a definitive answer for this in Ethereum Casper FAQ. But I found this:
Quote
https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQ#are-there-economic-ways-to-discourage-centralization
One strategy suggested by Vlad Zamfir is to only partially destroy deposits of validators that get slashed, setting the percentage destroyed to be proportional to the percentage of other validators that have been slashed recently. This ensures that validators lose all of their deposits in the event of an actual attack, but only a small part of their deposits in the event of a one-off mistake. This makes lower-security staking strategies possible, and also specifically incentivizes validators to have their errors be as uncorrelated (or ideally, anti-correlated) with other validators as possible; this involves not being in the largest pool, putting one's node on the largest virtual private server provider and even using secondary software implementations, all of which increase decentralization.
One strategy suggested by Vlad Zamfir is to only partially destroy deposits of validators that get slashed, setting the percentage destroyed to be proportional to the percentage of other validators that have been slashed recently. This ensures that validators lose all of their deposits in the event of an actual attack, but only a small part of their deposits in the event of a one-off mistake. This makes lower-security staking strategies possible, and also specifically incentivizes validators to have their errors be as uncorrelated (or ideally, anti-correlated) with other validators as possible; this involves not being in the largest pool, putting one's node on the largest virtual private server provider and even using secondary software implementations, all of which increase decentralization.
This is not exactly the question that you addressed, but they are suggesting here to destroy coins from nodes that misbehave.
Everything is still a proposal in ethereum casper (POS).
But, one other way to deal with this malicious user is to put his deposit as a block reward so it could be shared like transaction fees to validators.
