I was worried that their service could be abused in an attack-by-proxy (or in this case reconnaissance-by-proxy) scenario, so I contacted them. They were kind enough to reply to me very fast, and here are the things I learned:

• They are confident that the limits set in their Terms of Service are enough. At the moment of writing this post these are the following (but they can change of course):
• There can be only one active (running) scan from one IP
• Maximum 5 scan requests from one IP per 24 hours
• Maximum 20 scan reqests from one IP per 7 days
• Scan timeout is 60 min
• An other safety measure is the fact that the logs are kept and are correlated with the requesting IP.
• When I saw the possibility to enter an arbitrary command line, I got very nervous and asked them if they considered command line injection? Thankfully they said yes and reassured me that they taken the necessary security measures (and also that their logs were full of attempts to verify the existence of an exploit)

Given all this, I can only say: scan away!