Phishing messages from someone on my friends list

got a steam message from a steam friend who at least used to be a real person i met through backlog assassins with the vote for team shonk scam. i’ve reported the site through firefox / google and am not worried that my steam account has been compromised because i didn't enter any information and used a browser without any of my steam information. the domain was just registered yesterday and the spoofed steam login page was pretty obvious to me. also the messages i’m getting definitely don't match up with the way my friend writes.

what do i do about my friend’s account? i see playtime within the past 24 hours and i don’t want to make things more difficult for the rightful account owner by reporting the account but i also don’t want anyone to fall for the scam. i don't have contact info for this person other than through backlog-assassins.net where they haven't posted in a few years and steamgifts where it's been almost a year since they won or gave away a game.