@monsterer I think you can handle the attacking problem by changing CER. You may want to set CER very high so users don't pay any UIAs as a fee, while you pay the fee via fee pool.
If an exploiter begins attack, you can decrease the CER and he/she will has to pay fees for the attack. And you can limit your damage by not putting enormous amount of BTS in the fee pool (if fee pool is 0, people have to pay fees in BTS)