Good point "here's our Github account" would become a common solution for free private repos.

Short of biometrics, there is no way any online service can differentiate between you and another person with whom you have shared your credentials.

I'd like to hear counterexamples if you have any.

How does BitBucket? They don't, and that's okay, there will always be those who push the boundaries of the rules, but most people will be honest.

What about is tiers based on storage?