A method performed by a computing device in a distributed computing system having a plurality of servers interconnected by a computer network to provide a computing service, the method comprising: receiving, via the computer network, data representing a report indicating fraudulent account usage related to an account of the computing service, the account having associated one or more content items accessible to users of other accounts of the computing service; and in response to the received data representing the report indicating occurrence of fraudulent account usage, disallowing access to any of the one or more content items associated with the account while maintaining the account as active such that the account can still be accessed and a list of the one or more content items may be retrieved while downloading, viewing or otherwise accessing the one or more content items is disallowed; collecting usage data related to the account or the content items associated with the account while the account is maintained as active but the access to the one or more content items is disallowed; developing a model representing an activity profile of accessing the account or the content items associated with the account based on, at least in part, the collected usage data; and detecting additional accounts of the computing service that are related to the occurred fraudulent account usage based on the developed model without scanning content items in the additional accounts; wherein disallowing the access to any of the one or more content items associated with the account while maintaining the account as active such that the account can still be accessed disabling access to the account includes: receiving, from a user of one of the other accounts, an access request to access the disallowed content items associated with the account, and in response to receiving the access request: indicating, to the user, that the account is a valid account; providing, to the user, the list of the one or more content items associated with the account; and preventing any of the one or more content items in the list from being viewed or downloaded by the user. receiving, via the computer network, data representing a report indicating fraudulent account usage related to an account of the computing service, the account having associated one or more content items accessible to users of other accounts of the computing service; and in response to the received data representing the report indicating occurrence of fraudulent account usage, disallowing access to any of the one or more content items associated with the account while maintaining the account as active such that the account can still be accessed and a list of the one or more content items may be retrieved while downloading, viewing or otherwise accessing the one or more content items is disallowed; collecting usage data related to the account or the content items associated with the account while the account is maintained as active but the access to the one or more content items is disallowed; developing a model representing an activity profile of accessing the account or the content items associated with the account based on, at least in part, the collected usage data; and detecting additional accounts of the computing service that are related to the occurred fraudulent account usage based on the developed model without scanning content items in the additional accounts; disallowing access to any of the one or more content items associated with the account while maintaining the account as active such that the account can still be accessed and a list of the one or more content items may be retrieved while downloading, viewing or otherwise accessing the one or more content items is disallowed; collecting usage data related to the account or the content items associated with the account while the account is maintained as active but the access to the one or more content items is disallowed; developing a model representing an activity profile of accessing the account or the content items associated with the account based on, at least in part, the collected usage data; and detecting additional accounts of the computing service that are related to the occurred fraudulent account usage based on the developed model without scanning content items in the additional accounts; wherein disallowing the access to any of the one or more content items associated with the account while maintaining the account as active such that the account can still be accessed disabling access to the account includes: receiving, from a user of one of the other accounts, an access request to access the disallowed content items associated with the account, and in response to receiving the access request: indicating, to the user, that the account is a valid account; providing, to the user, the list of the one or more content items associated with the account; and preventing any of the one or more content items in the list from being viewed or downloaded by the user. indicating, to the user, that the account is a valid account; providing, to the user, the list of the one or more content items associated with the account; and preventing any of the one or more content items in the list from being viewed or downloaded by the user.