They can probably be prosecuted for the Harassment, which is a crime. IANAL but if you offer free automated signups with any email address it seems like invoking the CFAA is a stretch, as you aren't really taking steps to secure the system in the first place. The CFAA would be more appropriate if they are cracking admin accounts and getting into the back-end.