One thought on this is that we could allow/require instance administrators to specify an internal contact email/URL which is surfaced to users on the instance itself. So if you're a user, you get pushed toward the person at your company who administrates Phabricator, and we're sort of encouraging them to form a first line of defense. The upstream support channel would only be open to administrators. Dunno if this is really worth pursuing or exactly how we'd surface this stuff, but making it really easy for first-tier support to go to a local admin seems like it might be worthwhile.