A player with more or less than the required number of cards has a dead hand at the moment it is discovered. In your example, the player's hand should have been killed and the entire pot pushed to the other player (since it was heads up). If a player is cheating, we can't allow them to put themselves in a "freeroll" position where if we catch them they get their money back, if they win they hide the 3rd card or if they lose they just say "nope, I have a 3-card hand, it's fouled."
I had this happen to me today, heads up to the flop, player discovered a 3rd card in his hand (might have mixed in when dealer was mucking another hand or something). I announced the hand dead. He said "I had a chip on top of it, how can you kill a protected hand?" to which I replied "How could your hand be considered protected if a 3rd card was just mixed in?"