Per-service bans seems like the obvious thing.

Sure, there will be some rough edges (what when I am banned from GDrive but not Gmail, but then I click the 'save to drive' button in gmail?). Who will test that codepath?

How about when i DDoS the antivirus service API? - does that mean my email will no longer be scanned?

But a few rough edges for a few users seems better than a few users very unhappy and enough to become negative PR sources for life.