Revoking your API key is the equivalent of taking your application offline. And there's no fix; as soon as you reissue your application (after waiting a week for Apple's approval) then the spammer has your API key again and can start sending pushes through StackMob/Urban Airship.

I send a lot of push notifications through my own servers. I made sure that spammers would have a hard time abusing it by constraining (server-side) who can send what messages to whom. Unless I'm missing something, StackMob has no defense against spam whatsoever.

If spammers aren't already abusing this, they will be soon.