This crops up regularly in "hardcore" tournaments. His behaviour is unethical and unsportsmanlike, but it isn't actually against the site rules. We've asked several times for "hardcore" tournaments to be excluded from the vacation system, but so far it hasn't happened.
In the meantime, I'd suggest that you "name and shame", and make a point of being very careful with your own times, even turning on your own vacation flag at the last minute if necessary. His 36 allowed days will run out eventually, and he won't be able to do the same thing to anyone else in 2017.
Hopefully, the weight of complaints will eventually force the site owners to close this loophole.