It may be they had a legitimate reason to do this (perhaps some suspicious outgoing volume, reports of abuse etc) but whether they'll ever admit this is the cas

It may be they had a legitimate reason to do this (perhaps some suspicious outgoing volume, reports of abuse etc) but whether they'll ever admit this is the case is unknown. I worked at a big email provider and we'd VERY rarely log into customer accounts for anything other than support or abuse. In fact, I would hazard a guess that the only time it happened outside abuse or support was on an internal dev/test system to test updates etc.