Because, as I’ve explained in my Substack post, you’re allowed to create 10 different aliases to email 10 different Gmail addresses (same domain). But you’re not allowed to create 10 aliases to manage 10 Google accounts (also same domain).
How can Proton tell the difference? I don’t know, but they can. I know because I have created multiple aliases to email Gmail addresses, and it didn’t trigger anything because it’s allowed. Those aliases are still active.
Interesting discovery. Sorry to ask again but when you said “to email 10 different Gmail addresses”, it means you sent emails to 10 different Gmail addresses, but do you also receive emails from those 10 different Gmail addresses? Because I think it’s trivial for them to detect the difference between sending and receiving emails. And I believe it’s also trivial for them to store a list of “official addresses” of those services like Google and Facebook that are used to send email confirmation to users. I also believe they have enough data to build a filter/algorithm to detect that, since they operate a service that receive a huge amount of emails from third-party services everyday.
Proton didn’t allow me to create multiple aliases for the same website, so no, I have not experience this. But that doesn’t mean it couldn’t happen.
I see, I will test that with my throwaway SimpleLogin account when I have time. I will let you know the result. What you said makes sense, but I still think there are chances PSA emails won’t trigger an warning, because Proton can detect the difference, just like how you mentioned they can tell the difference in your 10 Gmail addresses case. The fact that there are people out there still maintain multiple aliases for the same website suggest that is a possibility. They must’ve also receive PSA emails from the same website during the time they have those aliases.
Thanks for replying!