[there]

no, /48 just becomes the new /29. it doesn't matter that there's many millions of addresses in the space instead of 8, it's still one contiguous space assigned to one customer, so you just blacklist the entire /48. it's currently done with entire /24s for big spammers.

ipv6 tunneling services have been around for quite a while and have dealt with spam fairly well, which is to say there's hardly any spammers using them because there's nothing worth spamming on ipv6 yet. by the time there is (meaning lots of mail servers), native ipv6 will be so prevalent that most tunnel services won't be needed, or will be much smaller and easier to police.