Well, you've already got that list, but here's one more thought:
you should devise a way to sieve out the hacked accounts.