Oh yep, totally agree - you have to do it, otherwise you end up with a server full of porn & torrent files!
If you want my formula, I drop all accounts into an excel spreadsheet and then normalise their disk and bandwidth usage to a percentage of the average. I then divide the disk space used by the bandwidth used (as spam sites tend to have low disk space but high bandwidth) and I assign that value to each site as it's "spam score". It's not perfect and you can't delete sites on the basis of it, but it gives you an early indication of the likely spam sites.
Hope it helps
If you want my formula, I drop all accounts into an excel spreadsheet and then normalise their disk and bandwidth usage to a percentage of the average. I then divide the disk space used by the bandwidth used (as spam sites tend to have low disk space but high bandwidth) and I assign that value to each site as it's "spam score". It's not perfect and you can't delete sites on the basis of it, but it gives you an early indication of the likely spam sites.
Hope it helps