The lock is in the radio part of the phone, a seperate processor and firmware, accessible through a radio interface (ril). GPL doesn't apply here.
To avoid having to deal with blocked AS, you have to monitor and control you customers. I scan all my ip addrs daily in the populars dnsbls. If a user gets listed, block direct outgoing mail (automatically), tell them to use the (scanning) smarthost and offer services to fix the source.
What ever you want is going to cost a little more than it is worth. -- The Second Law Of Thermodynamics