I may be wrong here, but does it really make sense when you can’t actually prove the misuse did or did not happen? Say, you suspect phishing, then it’s a matter of inspecting a few next e-mails to/from non-proton users to decide if it’s likely happening. On the other hand, when the account is blocked, proton (as long as the claims about at-rest encryption are true) has no way of verifying the claim, since, as far as I’m aware, a user can’t provide them with what they’ve sent even if they wanted to.