Live and learn. You've got to set your boundaries, and back them up. You weren't telling the customer to leave on a whim, or trying to move them onto a VPS to get more money out of them. You were taking steps to increase their resources and ability to stand up to the DDoS attacks, and at the same time acting to protect the rest of your client base.

Your "high risk" client would be in a pickle if their merry pranksters drove off the rest of your customers, forcing you out of business...and then forcing The Target to find a new web host.

I'm glad it seems to be working out!!