Well, in a shared hosting environment, the host can limit the number of emails that a user can send in a given amount of time. This will effectively limit the amount of damage that a spammer can do, and also render his eforts virtually useless, since spam works when the targets are very numerous. So even if the host doesn't take notice of his attempts, he will most likely give up on his own.

Things may get a lot more complicated when it comes to VPSes and dedicated servers.

Since spam often goes hand in hand with fraud, verifying all orders should help fight spam as well.

I'm not a host though, so a host's opinion, based on real life direct experience, would be quite interesting to read for me as well.