Although the spam was addressed to a particular end-user does not mean that the end-user requested it, or signed up for it, or had anything to do with it being sent. How the email address was obtained is anybody's guess. To bring this to management's attention, at least in the specific case, would, IMHO, not be appropriate.
You might want to have a generic policy about spam, agreed upon by management, and what your end users should do if and when it arrives, including some reporting guidelines, and with one option certainly being to make yourself available to help address and rectify the problem.
If you go to the users, it may be view as an accusatory action, but if you let them come to you for help, then it's much easier to deal with without getting personal.
Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein