They don't need to filter by destination.  Once a problem customer has been identified, they can apply an ACL restricting them to only originate IPs they own.

[..]

there are ways around that, including public shaming (here), or involving law enforcement.