An account that never paid is suspended for clear abuse
Mining, a port scan or a sweep of addresses, or mail sent straight to many mail servers now suspends an account that has never paid, as trying one internal address after another already did; its sandboxes are paused with their files kept. An account that has paid is still never suspended for it: only the one sandbox loses its network and is paused. See security.