This reminds me of a huge story last year where suspicious activity on an account got the whole company banned, including their personal gmail if they linked it as a recovery account: https://news.ycombinator.com/item?id=17115643