Going through the customers files isn't kosher and should never been seen as a 'good idea'.
If you don't want to suspend the customer, then just block DST port 25 from their IP addresses. If they only have a couple, you can do like
iptables -A FORWARD -p tcp --dport 25 -s IP -j DROP
Francisco