It sounds like you need to start reviewing your orders before accepting them. Also, how long does an account usually sit for before starting to spam? You could implement auto Demo-mode which will disable email on cPanel servers, then after say 24 or 48 hours, it will allow outbound email. You can't really do anything to completely avoid it except harden your infrastructure, scan outgoing emails, setup modsecurity, and enforce strong passwords. Maybe look for commonalities in the accounts that you end up touching, such as common reseller, common recipient as well.