This doesn't seem like a workplace issue, in the sense that I don't see a strong reason for the employer to get more involved than the email HR already sent out. Unless the harasser used company equipment to send the messages.
The harasser may know the victim primarily from work, but it sounds like they are using their personal Instagram account to communicate with other employees via their own private Instagram accounts. If the harasser were spreading malicious rumors, in person, to other individuals outside of work, would that still be a workplace issue? From my reading of the question, even if the (suspected) harasser were fired that would not do anything to stop these messages.
It might be properly handled by the employer, but the connection to actual workplace issues would have to be pretty strong. Otherwise, this is more firmly in the wheelhouse of Instagram (the company), the local police, and legal actions (like cease-and-desist orders or restraining orders). It sounds to me more like a question of what should I do if my friend is being harassed on Instagram than anything about the workplace.