Currently, a site suspend will suspend the site, but not the system user. Even if you change the password, if an SSH exists under the user you have to delete it.
There should be an option to suspend a system user. Disable sftp and kill running processes.
Additionally, if a site is suspended, access to the site via SFTP should also be suspended as an option.