Two things, I suppose—first, users can block services on the Notifo website, once they've [been] subscribed to them; second, developers have to sign up for an API key, so you can't just create a thousand spam services and subscribe a person to all of them.

I think it would pay to encourage users to use a shared secret in place of a username, though, since it's not going to be visible to anyone else, and so is really more of a "stream name."