kvm itself doesn't really give you anything in terms of control or management features. That all comes from libvirt or ganeti or whatever you've got. We've been using ganeti for a while and it does a reasonable job for our purposes but it is still a long way off from being something i'd feel comfortable deploying for customer use.

I think the intent was not to prevent staff from speaking freely (though certainly they specifically tell you not to bad mouth Telstra) so much as to make it clear to others that you are a telstra employee, even if you believe your remarks aren't biased because of it. It's not always apparent to others whether your remarked may have been influenced, after the fact.

* Disclaimer: i work for telstra and received the memo yesterday...

Those are the same options my former employer wrestled with. Many users don't care if they are a zombie spam bot, or at least it falls into the "too hard" basket. The choice (for the ISP) is "do i turn off service to my paying customers, or do i let spam go out to people who aren't my paying customers?". If the financial consequences of accepting that you can be a spam hub are less than the consequences of pissing off customers you've disabled email for, then you choose to let the spam run wild. Until the economies of this change (either it becomes expensive to send spam or it becomes expensive for ISPs to allow it), spam remains a problem.

This is a good thing, but it's unlikely to improve things in anything other than the short term. They are quite capable of identifying which customers are zombie spam relays already by looking at IP addresses and authentication logs. I did this back in the days of dialup when i did a lot of work on mail systems for another large isp/telco. They are still left with the matter of contacting the customer and explaining the problem and guiding through to a solution. This is expensive to do, and requires hand holding as the customer isn't going to understand what do. It's still cheaper for the ISP to ignore the problem. Zombies will still operate, just now they have to steal authentication details. Big deal.