Does it seem plausible that the scammers got the conference attendees' email addresses by scraping the conference web site? Or is the organizers' registration data compromised? This is a separate issue from the Doc-U-Scam.con legal situation... but it'd be far easier for the attendees to apply some heat to the conference organizers.

Otherwise, this sounds similar to scam emails that I regularly receive. (No conferences involved.) So I'd bet the situation is "legal", at least in the sense that nobody with real power cares to shut it down.

Idea: If some of the targets were from large institutions, and some of their credit cards were company-/govt-/university-issued, then suggest that they tell their email admins to globally block everything from Doc-U-Scam.con, to protect their institutions from fraud. If enough email systems bounced everything from those folks, then it'd seriously damage their business model.