The fact that he was chilling on the portal doesn't mean that he was hacking. He could have climbed the enderdragon with the help of the invisible blocks and fallen down there. Do you have anymore proof of this person hacking?
Thank you for your report. This report has been resolved. This thread was moved to Reports - Archives.