Doesn't this issue affect Tumblr (and Blogspot, and Wordpress) as well? They all allow arbitrary javascript to be injected by the user in a subdomain, so how are they tackling it?
IIRC only the blog front ends are on the blogspot.com domain. All user logins/blog admin etc are on the blogger.com domain (and no *.blogger.com domains).
(not used their services for ages, so there might be more overlap than i remember)
