> Then demand to see all the "real" data and select a random sample of 50 emails and track them all down to real people (or not), and ask the people at those endpoints what is going on
Apart from the privacy/compliance/legal reasons that make this very difficult. A very low proportion of 50 real paying corporate customers are likely to respond to an email from a seemingly random source, change that to 50 students you’d hardly get any.