When I resold services, I used Plesk – good account/customer security, looked professional, and the support was, whike not perfect, certainly better than a purely open-source product.

Everyone wants to what-if about email, but it was never a big problem for me, even with bad actors. Accounts were rate limited, and repeat offenders to the terms of service were kicked off the platform.

I spread out and lessened my vulnerability by sending emails to a smart host that, in turn, spread the mail load across multiple Postfix servers, each with a different IP address from a different block. If a server got blacklisted and that couldn’t quickly be remedied? It was just removed from the pool, and a new one was added.