Umm.. Darkhand, might want to consider not posting entirely in caps and putting in some paragraphs. Does make it easier to read what advice, if any, you are giving.

THE TOOL IS NMAP.
There's no guarantee that it is nmap. We can assume it's nmap because the user said the packets were "SYN Stealth" but then again it could be a homemade tool or another tool.

Your firewall advice is ok but keep this in mind, given that his existing producted detected it and blocked it, why would he get another product?

I'd also suggest to parth_scores to NOT contact this user. Help is better given in the open. Right now I'd be very paranoid as to what darkhand intends to do with any information you provide him/her (particularly from email headers).