Hello. I found this issue last week, and i want to tell you about it. Maybe is it not a problem but only a configuration. ------ If one of my customers logging into the controlpanel and adding: happycustomer.com with www. as subdomain(not *.) its works, and the customer is happy! BUT: Then another customer logging into controlpanel and found out the customer there has "happycustomer.com" is hosted by us, so the wise customer is trying to add a domain, like: "test.happyucustomer.com", without a problem.. This might be a bug?? I cant have some customers there can control other domains than they own self.. So.. is i the only one there have this issue?. Thanks.
ISPConfig has a module named "domain" to prevent that. It allows the administrator to restrict domain maes to customers by replacing the input field for domain names with a select field that only shows the domains that a customer owns. The domain module can be activated for the admin under system > cp user and under system > interface config.