Weasling in on an unprotected access point isn't exactly a capital offense, but it's also hardly fair to blame the victim, sablagorgaat; yes, if you make it easy to jump your connection you can expect it to happen eventually, but that doesn't make it your fault when it's somebody else knowingly doing it. On the other hand, it's hardly a serious crime, and the kid might not even know any better.
Therefore:
Releasing virus = bad; it doesn't just affect him, and it's rather destructive anyway.
Having a bit of fun by sending an "FBI is watching" message = an entirely legitimate and amusing prank.
Although I also like the idea of randomly killing his connection while he's surfing or in the middle of a download--my ISP pulled that on me last night, except I'm paying for their service.
Maybe annoy him for a couple days, then send him an unnerving message (how about "Your illegal use of this connection is being monitored. We know who you are."?), then cut him off. Have a bit of fun at his expense (which he left himself open to by leeching a connection, just like you left yourself open to leeching), but don't get carried away.