What is the threat model where correlating the payment with the account number is the main threat? If you can relate the account number to Mullvad traffic, then isn't it far easier to monitor the traffic and see what IP is connecting through it (my local ISP IP)? And if you cannot, what harm is there in knowing someone uses Mullvad? I pay by bank card and I don't see the risk here.