Aw, I feel pretty bad for him, because this isn't really that big a deal and it's sort of sweet that he's tying himself up in knots over the possible knock-on effects on his girlfriend's nan when really he probably just got scammed, and the police wouldn't much care either way anyway. It's really probably just going to be a harmless lesson about not making stupid purchases online.

When I was at university in the UK, a friend posted weed to herself from Amsterdam. She was caught because all our parcels were filtered through the university mail desk, not left in our mail slots. The uni called the police, who asked her if she did send it herself, then just told her not to do that again. They couldn't have been less bothered.