things that warrant disruption of service and are defined as abuse:

1) any type of DoS attack

2) phishing

3) malicious activity (ssh brute force, port scanning without consent, etc)

4) cp

5) anything that generates a court order with jurisdiction, including DMCA if you have anything to do with the US

6) spam/spamvertised site

there are more things that can be defined as abuse, but the others are more or less discretionary, imo.