There is no need for a dilemma. They could have use many degrees from soft to hard ban.
5 Minutes Ban,
1 Hour Ban,
1 Day Ban
1 Week Ban
1 Month Ban
They could take out all pokemon of the gyms, when a spoofer with a Weekly or Monthly ban. There should be a clear notice, why he is accused, and which step of punishment is active.
Other possibilities: regional restriction of an account, or forbid to be active in gym....
They can do many things to warn a player. Permanent ban should be the last resort.