If someone has already written a custom integration, how hard can it be to wire it up to a spam detection API? It sounds like the integration was sending spam (not intentionally of course), which none the less is a TOS violation.
If they can’t update the integration with spam filtering, then it seems like they should be using COTS software.