This is not the first time a YC company has "hacked" their way into success-- for example AirBnBs spamming of Craigslist users and violating Craigslists ToS in other ways. In fact, these kinds of things come up so often I wonder if it's not encouraged.
It's kinda balsy, though, to get client's admin ids, and then use that to go after their data.... and then when this is cut off, to complain about it.
Especially given the entitled and, if ADP is being honest, dishonest way they portrayed the events.