Tell your friend to send an email to hacks@blizzard.com with info like that it’s in Classic WoW, what realm, faction, who’s suspected of doing what, time frames and whatever else is relevant. You can even include video footage/screenshots and so on in the email.
You can tell your friend to spread the word if it’s already a realm initiative to keep track of that character, and have others send in their own emails.
Also don’t forget to mention that it’s an EU realm in the email, because the email goes to their Californian HQ.
The right-click report function is automated, X amount of reports close enough together all reporting for the same thing have predetermined punishments that’s dished out automatically. Not enough people have actually reported him yet and close enough together time-wise, evidently.
Keep right-click reporting though, the ones who gets reported an abnormal amount of times stands out in their server statistics and gets swept into their banwaves sometimes.
So use the email, it’s the last open line to Blizzard beyond the support forum. They never reply though, so don’t expect an answer.
By the way, notice how while Actions Taken Against Exploitation -- July 1 Update
they say it’s up to 4k accounts globally per day that gets suspended, they don’t actually specify how they deduce it. Sure, it’s their policy not to, but it just so conveniently forgets to mention, and separate, the automatic suspensions by the Warden (their anti-cheating software), and which ones are dished out manually.
So 2-4k accounts per day globally, when possibly including the accounts getting struck by the Warden without Blizzard lifting a finger, doesn’t actually amount to much.
So all you can go by, is the effect that you yourself can see. And the bots you can still find on your server, and general rulebreakers such as the ones sharing accounts to painfully obvious degrees like the @OP described, can speak well enough for itself.
In other words, those kinds of statements are just corporate speak. Damage control by the community management team. It’s just them upholding the image of doing something, making it harder for the masses to understand that not even close to enough is being done about it.