I agree with your point. If a customer was reported as DDOS attack, we would suspend the VPS immediately then then send them an email to inform, cos it would affect other customers on the same node too. We give spamming complaints/reports customers 24 hours to solve the issue.