Shamelessly plugging sparechange.io we take abuse seriously. Just create a ticket on our site, we require proof of site ownership (place file / DNS txt record) and abusive API key is banned (all websocket traffic becomes HTTP Unauthorized so no mining).