How do you intend to generalize this case to other websites with user-generated content? Because the precedent set today is that a single threatening user-generated comment is enough to pull Cloudflare security services for the entire site, regardless of how quickly the website performs their own moderation, as long as it stays up long enough to be screenshotted and passed around on Twitter. That's basically carte blanche to deny service to any website with user generated content whenever you want.

Cloudflare's post the other day seemed like a very reasonable framework for making decisions on issues like this, but Cloudflare's actions today just severely undercut your credibility on this issue.