Detection of compromised or abused user accounts for multiple services