Is it permissible to suspect someone of being a spy based on evidence and indicators, and what should be done in this case?

The default is to think well of a Muslim. However, if suspicious actions (circumstantial evidence) emanate from him that necessitate ill thoughts, then there is no harm in taking precaution and being wary of him, because he has placed himself in a position of doubt.