That's basically true. If we received an abuse complaint for one of your users, we'd probably give you a warning (and request that you terminate the user's account), but further infractions could result in the loss of your account. We have a lot of people who use freemail services like Big Mailbox to provide free web-based mail; when people use these as drop boxes for spam mailings, we usually just ask the customer to get rid of that account. Most of our customers are good about this, so as long as there's no evidence that they're complicit, and as long as they take action, we don't sweat it.
You are responsible for any activities of your sub-users. Personally, I wouldn't suggest giving an account to someone you don't know or trust.