The way I read it, that would work.

But since the intent of the action is clearly to cut off the competition, why would we assume they will stop at "just" email address? That's their first sortie in what could become a long war. Next it could be IP address, then they could subtly alter their API to break automated access (and give out a different API to trusted insiders), and so on.

Ultimately when it comes to web-scraping and unauthorised usage, the advantage is always with the home team. They have the ability to change things any time they want, and the user is always caught behind every change (and they could literally change things once a day).