As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.
Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.
There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.
Received an email from campus IT that my phone was compromised.
On further digging I would load up a game every once in a while on the campus wireless. That game used a popular/legit Chinese CDN to host something on their news page which was flagged.
Easier to just use my wireless phone package instead of explaining my phone wasn't compromised.