Regulating services can only go so far because as long as general purpose computing exists people will eventually be able to perform all of these abuses locally.
I think the only solution that will work in practice is to go after the abusers based on their intent. Going after technology providers is never going to work because the technology is fundamentally general purpose. Wherever the line is drawn, it will always be possible for abusers to take it and specialise it for abuse locally.
Edit: to be clear, I can't think of a legitimate use for this service and it sounds like their behaviour is abusive and they should be shut down. But that won't stop the abuse because sooner or later abusers won't need a service to carry out this abuse. They'll be able to use a generic tool to do it locally instead.