there's another issue here too: GMAC isn't only trying to punish the people who used scoretop, since there's really very little benefit to GMAC in that action alone; rather, they're trying to discourage others from providing live questions (the 2+ million dollar decision helps ensure that) and discourage others from visiting sites that advertise live questions (the canceling and banning for life ensures that, since the punishment is so over the top. if you're banned for life, your hopes at an MBA are basically gone. better to take the LSAT instead). Keeping that in mind, it's perfectly logical that GMAC would ban people, since it's the most effective deterrent that they have.
As to the ethical discussion of whether they should be punished or not, I think it really depends on how obvious it was that scoretop was making live questions available. if something on the website said 'pay us and we'll give you LIVE (LIVE! LIVE! LIVE!) questions' then it's pretty difficult to argue that people who paid didn't intend to cheat, even if they (supposedly) didn't look at the questions. As has been said before, the benefit to the VIP members was probably negligible because of the size of the question pool, making the actual question of cheating (in the sense of seeing questions on the exam that one had already seen) entirely moot.
If, on the other hand, there was little advertising of live questions done on the site, then it's perfectly reasonable to assume that people that paid are just doofuses/exactly like your standard
mgmat or gmatclub or beatthegmat subscriber. in this case, they probably shouldn't be punished.
now, i never saw scoretop, so i don't know what the website looked like, but they probably wanted to advertise the heck out of the business of having live questions, because that would provide significant competitive advantage vis-a-vis other sites like gmatclub. if they didn't advertise them, they'd be running all the risk of having the questions without nearly as much revenue because fewer people would pay--which seems like bad business practice, and is basically implausible.
now, i think personally that GMAC is being unnecessarily heavy-handed, but they're trying to protect their business from current and future assailants, as well as from the GRE, and to do that they need to ensure their credibility with the schools. And they're within their rights, and it makes sense. the only thing we can hope will happen, really, is that more schools will take the GRE (as might happen) and that GMAC will harm its competitive position.