While I don't know anything about how multicast is specified, I would certainly hope that it is possible to implement in such a way that each router only needs to track the memberships of it's direct neighbors. They would then themselves advertise that membership in order to serve their neighbor's request.
As for the abusive client, I say if the ISP has any sense of self preservation, they should be interested to police this themselves. For example, knowing how much bandwidth the client is paying for, they could refuse additional or even cut existing memberships of that client once that limit is reached.
The problem is that a router's direct neighbors may be subscribed to millions of multicast groups and nobody has enough TCAM to track those memberships.
As for the abusive client, I say if the ISP has any sense of self preservation, they should be interested to police this themselves. For example, knowing how much bandwidth the client is paying for, they could refuse additional or even cut existing memberships of that client once that limit is reached.