Go to your account settings and uncheck "Show others my online status". He's using the list of online people at the bottom of the main page to PM spam.