What do you do after you catch them? Is there any place to report them, maybe depending on which country they are based, or you simply stop doing business with them?

Same. Particularly interesting when you start getting spam to massiveCreditReportingCo@mydomain.com, or who sends mail to boughtaNewCar@mydomain.com after giving that address at the car dealership.