(1) There is no point in complete cutoff -- partial filtering should be enough. So if email spam is sent, outgoing SMTP port is blocked; if there is a virus spreading over random ports, all outgoing ports except http/https are blocked; if malware leaves spam on webpages, then all http/https connections are redirected to captive portal explaining how to fix.

(2) Same with spam blacklists, you get de-listed either automatically, if few weeks pass without incident, or faster by manual request.

(3) It should not matter why bad traffic was sent. A much more realistic situation is: "So you work from home and your computer gets trojan which starts to send phishing emails, so now the ISP cuts you off from the Internet. Now what?"

In either case the answer is: prove to humans @ ISP that you are no longer danger to the internet and ask them nicely to unblock you. If you work from home is that critical, have a separate internet source (say 3G modem which you activate with a phone call)

You call them and get it turned on again. Also, shut off doesn't have to be right away, it could be after a few days of intense spam, and a week of upload constrained connectivity. In other words, you can find a sensible policy.

So you work from home and your 12yr old discovers loaded revolver in night closet and shoots few friends, so now the Police come and arrest you. Now what?