hello
i would advise a script like xpanel, cpanel was designed and is designed for paid hosting, offering it with free hosting is not a good idea
1. its too powerful
2. it was designed for around max 100 accounts per server, therefore it can become bogged down
i myself use xpanel, although there is probably other similar scripts, i have a host with 10k accounts and am setting up a second with 30k accounts (with php and mysql) in a multiple dual core dual xeon cluster

, i find it works very well.
one of the majour features is the file checking perl script which checks both files uploaded via ftp and the filemanager. This is EXTREMLY useful for getting rid of phishing sites, for example you could remove all of the phrases "bank of america" etc.. and as soon as you found a phising site that got around it, you could just add a check to the list.