This could be an issue with the control panel software being used. But we would like to see a way to force an email address to be disabled (with or without mail) and not allow the api to turn it back on.   We get alerts that an account is spamming and the customer doesnt know what is wrong with their account and just resets the password using the control panel (not smartermail) and the account is re-enabled.   We need a way to prevent that from happening.