If you run a service that can be abused like this, you're going to need objective account abuse metrics to warn you before these things happen. Specifically you're going to need a Russian speaker to prowl around on Russian forums buying your own hacked accounts, so you can figure out the market price. If accounts on your system are selling for ten cents, might be time to reflect on account security.
Absolutely. Edit: Although it's rarely direct. Normally big corp will engage a security consultancy and discuss type of reconnaissance as one part of a wider strategy.
