The lock is in the radio part of the phone, a seperate processor and firmware, accessible through a radio interface (ril). GPL doesn't apply here.
To avoid having to deal with blocked AS, you have to monitor and control you customers. I scan all my ip addrs daily in the populars dnsbls. If a user gets listed, block direct outgoing mail (automatically), tell them to use the (scanning) smarthost and offer services to fix the source.
You can't have everything... where would you put it? -- Steven Wright