You don't need to force them to update. Just bill them whatever the misbehavior costs, and the user can decide whether to pay increased bandwidth bills (or the cost of other liabilities) vs perform/obtain the maintenance needed to prevent these costs. Users can decide which approach is in their bests interests.