I think, you've taken correct actions for this suspicious activity.

Email limit 250 per hour is ok and they should be sent using business domain name.

In such cases, we normally give 24 hours to stop this activity, then suspend a hosting and provide refund if applicable.

But if we found suspicious/spam emails then immediate action should be taken.