I ran into this problem a while back. Someone uploaded porn via IP to an unsecure script and leached a 100 gigs of bandwidth in a day bypassing the bandwidth limits of the account that had the unsecure script.
I was too lazy to research why mod_userdir wouldn't turn off. Instead I left mod_userdir on and change the UserDir from:
UserDir public_html
to
UserDir somefakedir_html
which gives them a simple site not found
I also found that going to
http://ipaddress brought up the first virtual-host's website. Something resellers don't want. So I added a subdomain of iponly.mybox.com and moved it to the first position in httpd.conf then added an index.html which says "You can't access your website by IP Address, contact your hosting provider if you are having problems."