Have you considered just turning it off? Or adding a requirement for API keys and disabling any that they hand out to their customers. It would be pretty embarrassing for a large company that had a service go down because they refused to pay for it.