I have had that happen before with Proton and wondered to myself: How are they assessing this? Whether they were right or not, it required a lot of analysis that in theory wasn't supposed to happen. I'm not saying anti-fraud systems are inherently bad, but how can you have an anti-fraud detection system in a privacy email service without reading emails or using javascript to try to measure a user's machine information?

They do that because as a small provider the alternative is getting wholesale banned by the third party site which affects all their customers. I encourage you to read blog posts from the people that try to run small email services that aren’t Google and Microsoft, it’s nearly impossible because website administrators are extremely quick to ban and impossible to contact. Then your customers leave when mail doesn’t work.