I have spoken publicly about this issue on several occasions. Using the "moral" argument, the fact of someone posting on a project in such a manner is grounds for another individual in receipt of this information to act. In previous instances too numerous to count, the posting was brought to the attention of the admin community, and inevitably someone at the office on IRC, with the question "what do we do?" "We" of course is the problem. If we mean the community, we're talking about a whole lot of editors around the world; if we are talking about admins, a narrower group; if we mean the foundation, then we are taking about a handful. Point being, you contact authorities if you believe the threat is credible. You do what you can because ethically you don't want to be responsible for having the capacity to act and not doing anything.
These kinds of situations are a tremendous time sink and a point of stress for all concerned. But, if they are simply ignored, one day it will turn out the warning signs were there, something awful will happen, and we will be tarred and feathered. In my view, imposing any type of obligation as a matter of policy is impossible. We assume good faith; we should assume people who intersect with something as unusual and concerning as this will do the right thing.
Brad