yup, that's one of the big per-account costs; paying attention to the abuse box and shutting down spammers. But, the problem is probably better addressed by just requiring a long pre-pay which you don't get back if I think you are spamming.

The real problem is compromised accounts. How draconian should I be about that? I mean, personally, I'm not sure. Policy is to shut them down, give them a fresh VPS and let them mount the compromised one read-only; But, about 5-10% of people re-infect themselves immediately, presumably by copying the infected webapp off the backup.