Why CQ means "calling any station," so the answer is a direct call to that specific station. Standard practice is to address the station first and then identify yourself: "W1ABC, this is K2XYZ" (or just "W1ABC K2XYZ" on CW). Saying their call first tells them the transmission is aimed at them, and your call sign at the end is what they need to write down and come back to. It also satisfies the identification requirement of 97.119 since your call sign is transmitted.
Watch out Giving your own call sign first is a common slip, but that is the pattern for calling CQ yourself or for signing off, not for answering someone. Repeating "CQ" back is wrong because the other station is not calling generally, they are the one being answered.
Address the envelope before you sign the letter: their call, then yours.