When you see a red flag of unusual activity, what you're trying to do is figure out "Wow. Has the real person's identity been stolen, and am I dealing with the fraudster, or the real guy?" So, your response should be tailored to enabling you to discern the difference between the real person and an ID thief.
If you're dealing with the right person and you can help them become aware of ID theft that's taken place elsewhere on their identity, even better. Have them go to FTC.gov, or you go there and get them the summary or rights of ID theft victims. It explains what they should do.