Pro-tip: you did a great job wiping a great deal of evidence.
Disclaimer: I am someone who actually deals with this as a part of his line of work.
The guy resides in Brazil (the other side of the world to me). Realistically what would have happened if I had contacted the Brazilian police about such an issue? Do you honestly think they would spend any resources on such a small player in the Cybercrime world? I contacted all the other companies he was renting from instead, which I thought was much more proactive.
You cannot waltz into an account that is not your own and make changes. It doesn't matter if the user is in Brazil or not, the United States and them have an extradition treaty signed back in the 1960s. If an American agency thinks that a Brazilian is involved in a serious breach, they'll make use of that treaty to the best of their ability. Don't forget about about the efforts made to try and get Gary McKinnon.
I don't care what altruistic goal you have here, you do not go and do this sort of thing. It's far from appropriate and you shouldn't go around trying to excuse it because they're of some nationality. You should not assume you have not compromised an investigation here.
But agree, he could have just snooped around to gather whatever info he needed and also notified law enforcement.
I wrote on this years ago:
https://afreak.ca/blog/a-look-at-data-retention-and-law-enfo...
He should have left the e-mail account alone or at the very least made an offline archive if he truly wanted to look at the data for research reasons.