So they pretty much ask you to DoS their users

If that's what they want, and if you do have a valid CPDoS then do it