Since these two pages have been deleted (from public view at least) and they have not moved somewhere else - so there is no equivalent page to redirect to - then the appropriate response is a 404 (as you are already doing).
However, this should be a customised 404 with an appropriate link to the parent page (user profile), so users remain engaged on the site. The user now understands that the URL they followed no longer exists, but are guided to the nearest available.
Google sees the 404 and eventually drops the page from the SERPs.
Can I redirect or not?
Redirecting to a "different" page is likely to be seen as a soft-404 by Google - this is likely to be the only "penalty". As with a regular 404, Google is likely to drop the URL from the SERPs. Since the page doesn't exist anyway, you can't really argue with that.
For the user... The user is redirected to a different page to what they were expecting. This could lead to confusion and an increased bounce rate.
There is also another issue with redirecting... how quickly do you want these pages removed from the index? The cached version of the page might still be available. A redirect (soft-404) might take longer than a proper 404 (which is still subject to some delay). A 410 Gone would be even quicker.
In summary... A customised 404 would be preferable. A redirect is unlikely to see an additional "penalty" with search engines, but could potentially result in some confusion.