I could see some sane limits being needed to prevent abuse

that's what I meant with "users who have less than say 20SP can be extended up to 20SP towards bandwidth". So really, the worst "damage" any individual user could do to the registrar's total SP reserve is 20SP. And as a global variable set per registrar, they could always adjust that for all their delegated sub-accounts, or even more granularly on an individual basis if the need arises.