[cuu508]

OK, but in this specific example, what would you do in the shoes of Hetzner?

My understanding of the situation is, somebody in Network A is sending spoofed traffic to Network B. Hetzner receives abuse reports from Network B.

Should Hetzner either establish trust or cut off: Network A, Network B, or their customer?

Hetzner has or should have means to verify that their customer is not the one making port 22 requests. They are not the attacker. Network B is reporting the issue, they are also not the attacker. And Hetzner cannot identify Network A, at least not without Network B's cooperation. And even if Hetzner does identify and cut off Network A, the problem remains – Network A can still send spoofed traffic to Network B.

[bornfreddy]

If they feel like it, they can reply to the abused party that they have misidentified the attacker (and why). It is up to the victim to then research further if they feel so inclined.