Are you sure they were using zoom hack and not playing on non-standard resolution?
It is common to comment on my screen when I stream because I play on 21:9.

I’ll assume they were zoom hacking since they didn’t defend themselves or try to explain anything to you. I do however believe you should’ve had a conversation with them first before kicking. Mainly to ensure the group safety in order to not get suspended.

You should also know that finding a replacement, especially for an Ultimate encounter is very hard. Better keep them until you find a replacement in order to not waste time and hold prog back.