Let them take the gym, see if they're dumb enough to put stuff in, if they do, file a report.
I don't know how Niantic works but I'm guessing they only ban players that are blatantly cheating, for example 10 accounts with similar names all placing Pokemon into a gym within 30 seconds of each other, since it's possible that a player could make false reports.
I have reported a few players that I've "caught" spoofing, they were definitely not in the area, but nothing was done about it.