[suresk]

Not defending their actions in this particular case, but yes, I think it is completely reasonable for a service like MailChimp to be concerned about unauthorized use of user accounts. If someone takes over a MailChimp account, it is almost certainly to send spam/fraud type stuff, which causes harm to MailChimp in various ways.

Compliance with those standards doesn't mean they aren't potentially impacted by that sort of thing, and doing what they can to detect and mitigate unauthorized user account usages is part of at least a few of them.