I wonder if action they took against my account was a result of them trying to mitigate these attacks from Uber. If so the damage is much worse than just the canceled rides.
> the risks of using customer's credentials in such a careless and ridiculous way many magnitudes higher than the potential rewards
Are you sure? What are the risks of parking a username? I doubt it's illegal and I bet they could obfuscate the traffic well enough to make it very difficult to prove to a court that they were the ones doing it. The only downside seems to be a bit of slightly negative PR (i.e. the assumptions of those who jump to conclusions) when Lyft detects the widespread parking.
Meanwhile, the upside is the expected value of their most profitable customers times the probability that they will switch to Uber+Lyft or 100%Lyft.
Low risk, large upside... I don't think this is as bad a business proposition as you make it sound like.