yes its obvious the customers have to upgrade the script and its going whack a mole bassis , we keep flagging the user while we disable the script but somehow some dumb user restores old backup or something and this malicious activity repeats. we again go through process of finding the spam then searching the script then blocking the script again messaging the customer, only to find it happen with another user after sometime again repeat the same process , which totally damages IP reputation as its constantly getting blocked.
I totally agree the server needs to be sanatized and scripts upgraded but when you have US$ 1-4 dollar shared hosting where sometimes non-tech savvy people or some kid in school trying to host his project uses old scripts and doesnt u.stand why upgrading is so important, some companies do not want to hire another developer to upgrade the script and constantly tell us at hosting to "FIX THE DAMN ISSUE, Why is your server bad? this is hosting issue, else i will take my business somewhere, I have lost $2000 dollar business cause you disabled my website , i am going to godaddy if you dont enable" instead of fixing the script by upgrading, this is constantly going to happen no matter what we try in telling them to keep scripts upgraded.
I wish There was some auto-disable system within drupal or wordpress itself which kills itself once it is vulnerable. this is the reason i am trying to find a way to do it with Mail MTA itself or some firewall rule or csf or something. ps:sorry about the rant.