That's a good question. I'm actually not sure. When the SP is delegated and not owned by the account there could be a mechanism put into place for reporting this type of abuse to have that SP delegated be revoked?

Of course with any solution we come up with, we have to ask ourselves if the solution could be abused as well.