The intersting part of this is to find where the line gets blurry. For instance is it ok for legitimate Apple ID owners (e.g. people who actually own an iPhone) to access iMessage through a third party spoofing their devices.

I'd say yes, even if Apple can't separate them from the other problematic accesses.