tl;dr Don't spill the beans, or some bad actors will just avoid those things when using AI in the future
Related reading: @Makyen's answer to "How can we determine whether an answer used ChatGPT?"
In my experience, we have several categories of users using AI to assist (entirely or partially) in writing answers to questions. To recap from another post I made on MSE:
Users who have used it (mostly) responsibly. The current policy for Stack Overflow is still that this is not allowed (but now impossible to enforce, of course).
Then we have users who I honestly believe are trying to be helpful in answering a question, but they don't understand the perils of unvalidated AI output, and post without verifying (and often not even fully understanding) their answer. This is not responsible use. Most of these users will stop when the policy is pointed out, but some simply don't agree with the policy and will continue. These then, become "bad actors" (a term that means the person isn't acting in good faith).
Then we have the "bad actors" who are simply attempting to "farm rep" for one reason or another (perhaps even for spam purposes). This is also not remotely acceptable, as the trust and reputation earned on SE should represent the community's assessment of the user's expertise. Some of these users are doing it without knowledge of the policy, and stop when it is pointed out, and others, sadly, have no regard for the rules.
And finally we have spammers of various sorts, either explicitly in the answer or through profile links. Clearly these are also "bad actors".
The problem we have here is that the bad actors, given knowledge of how we identified something as likely ChatGPT/AI, will simply use that information to modify their answers in the future to attempt to evade detection. Since bad actors are almost always new users, they'll often simply delete their account and start over with a new one that doesn't have the "tarnish" of the old, already identified account. Of course, moderators have tools to help identify this (after the strike is over, of course), but I believe they generally have to look manually.
Even if the user is asking in good faith, others who aren't so well-inclined might see the info and use it more maliciously.
It may be tempting to want to "prove" you are right to the user, but telling them why you identified it as likely-AI is just exposing us to more potential ChatGPT which will be harder to detect in the future.
So what to do?
A standard response could be something like:
I really do want to believe you here, but one of your answers included information that is very rarely done by a human author, but quite often done by ChatGPT. Then you had another 6 answers that also had things we see often from ChatGPT. It just seems unlikely that this is all your content. Again, if you used AI to assist with any answer, I would encourage you to delete it.
That keeps it vague enough to not give anything critical away. Also, absolutely do re-evaluate your stance, back-down, apologize if you think you might be wrong at second glance. I tend to have varying levels of responses based on how confident I am that the content is from ChatGPT/AI.
Another possible reply that I've used is something like:
Unfortunately I don't go into specifics on the indications of why this might be AI-based. We do have some folks here who appear to attempt to hide their AI use, and they might use that information to do so.
I don't consider this "security through obscurity"; just trying to avoid giving out the password in comments ;-).