In messaging with support, they advised that the system would 'automatically' identify the account as compromised and eventually block it. This doesn't seem that likely so I will ping them again in a few hours.

That's good news. I will reach out again and try to get it blocked at least but so far they have been unwilling to do so.