Spammers will often register paid accounts with stolen credit cards, and opt for lower tier accounts because the small charge is much less likely to trigger fraud protection than, say, attempting to subscribe to Workspace Enterprise.

Google almost certainly has, and has consulted, internal analytics on where these spam campaigns are originating and which account tiers they are abusing most.