Summary Dismissal for Gross Negligence
It's the only course of action. People have to be made aware that THEY are responsible for information they give out. If they are on the net, the need to be aware of the risks and threats of the net. Just like drivers are trained to be aware* of the risks and threats on the road. Ignorance is not excuse and if they do claim ignorance they should be disconnected IMMEDIATELY and not reconnected until they prove competence.
People need to take responsibility for their actions and the only way to do that is to MAKE them responsible. Especially when they hold positions of responsibility like a doctor or similar. Once people get that the net is not just MyFaceTwit and poses real threats to them, they may take more care of how they set themselves up and what software they use.
Of course, there should also be action taken against phishers and their agents (those dumb enough to let their PCs become drones). ISPs forcibly disconnecting and disconnection of ISPs that do not take such action would be a good start.
*BMW, Merc and Lexus drivers excepted, they can carry on being total wankers.