The idea that a file was deleted as a first step is pretty out there. There is NO evidence of that. The usual progression is to deny streaming, then warn and close account ultimately.

Question is this a paid google storage / CDN account? That would be different. It sounds like this is bog standard gdrive.