I've heard that pool operators shut down the botnet operators' account, so they get DDOSed, but I haven't read that directly from a pool operator.