Hmm. I set a friend up for that "three years free hosting" deal with 1and1.com when it was posted way back, and my friend used it to host a video-game video that I helped him put together, and it was locked within a couple of weeks due to bandwidth exceeded for that month. Never saw anything about needed CC details to unlock it though, that's probably what happened. They didn't automatically unlock it the next month either, and my friend (who is not very computer literate), hasn't been able to use it since. But I did set the overage cost limit to a very low amount (I think $1.00) when I helped him set it up, so I don't think that they would go after him for charges.
But.. for 200+ GB/mo... an overage charge of $240 isn't exactly "unreasonable", considering that the free transfer limit per mo is supposed to be 5GB. If you don't give them your CC details up-front though, how are they going to be able to charge you that?
At least they're not as bad as Prohosting - sending an "invoice" for services advertised as FREE, and then sending followup e-mails threatening me if I didn't pay them. When I realized that they had NO personal details on me, I just ignored them. But that's a sleazy way to do things. At least 1and1.com is up-front about being charged on the free account for overages.