I use directadmin and cpanel for other existing projects. One feature I really like in DirectAdmin is when an account has sent out a mass amount of emails. DA will tell me, when, what account, the the script that was used (usually some malware type file)
So when I get those emails, I know to take care of those account right away.
Could something like that be implemented into enhance.