Here's the attack: The user writes software which performs the same authentication handshake as the official client, but after the handshake it starts sending evil messages to the server.
Or am I really missing something and should just stop commenting? :)
In other words, your EULA/terms-of-service is a long the lines of "you are responsible for the user of this service using your login credentials, which can be revoked at any time if we perceive you to be violating the terms of service". Then becomes a little more manageable as a social problem (which it is), rather than solely relying on a technical solution to a social problem.