This is the sort of thing that sounds reasonably nice and we all wish we could do. However it stops working really fast.

I also have a web service and we used to let people get away with this sort of stuff. First year it worked. Second year, the amount of fraud was impacting bottom line and some of this users turned out to be the ones that used "support" the most. So we started banning bad users and blocking their support requests. The overall impact to the "good" users is pretty noticeable now. Not only can we reply to their support e-mails faster, but the overall system is also faster.

My mentality shifted. Now I think you "owe" it to the "good" users to remove/ban the ones who steal. They are most likely not zero sum, but pretty negative.