1) Summarily fencing/sandboxing/disconnecting clients sending high volumes
of spam, virii, etc. You might politely contact your commercial/static
clients first, but anyone connecting a "bare" PC on a broadband circuit is
too stupid to deserve coddling. The great majority of your clients would
thank you profusely.
So far as I can see, detection of serious abusers should pretty
straightforward. It wouldn't require any pretense at spam or virus
filtering, per se; just pick off the clients that are flagrant sources of
the plague of the month.