If you are saying a client got hacked and doing abuse activities, then it depends, but these kind of problem are very likely affecting other users and our network, so suspend would be my best bet.
unlawful contents would be the least of our concern at the moment, a goal we want to accomplish is to isolate the users as much as possible.
as a lot of us know a Virtual Private Server is not that "Private" at all if you know what i'm referring to "Network Security".