It's clear that you haven't run or owned a business. Otherwise, you wouldn't be so cavalier about rewarding criminals and thieves.
It is not a scam if someone gives extra money as a refund. When you click send on the bitcoin client you are confirming the sending of that amount. The person that receives that amount is under no obligation to return that money. The user signed up for nonreversible payments when they used bitcoin. They also agreed that the owner of that bitcoin address is the new owner of the amount of bitcoins sent to them.
In fact an investor of blockchain.info violated its terms of service. If I violate the terms of service of a service I use then I may lose my account or have to pay a fine. If an company breaks its own terms of service of its account and and released that information to a third party then that business needs to pay a fine to the customer that was harmed.
Below sums up the problem very well.
It is inappropriate for someone who has admin access at blockchain.info to use that information for the benefit of some other business. As a matter of fact it is explicitly against the blockchain.info privacy policy:
In this instance bitcoinstore.com is a third party, and you have distributed the personal information of one of their users to that third party without the user's permission and without being required by law to do so.
If I had a business where I let an employee or investor have access to the company car, and that person drove over a customer; my business that allowed the employee/investor use that car would need to pay retribution to the customer. Me telling that customer that I took away the employee's keys is not enough.