The way to scale this is with actual laws. For example, it's hard to believe that an organisation not only handing over an obviously personal account to enterp

The way to scale this is with actual laws. For example, it's hard to believe that an organisation not only handing over an obviously personal account to enterprise management but then failing to fix the problem when explicitly notified isn't in flagrant breach of the GDPR in Europe. The entire account tied to a personal identity could reasonably be considered personal data, which brings obligations in terms of properly managing and safeguarding that data and in terms of allowing the user to retrieve it and erase it, among other things. I'm not generally a fan of how the GDPR was implemented in practice, but in cases like this, the sledgehammer-nut principle might well work in favour of the little guy. Going after both the hosting service and the former employer if they fail to disconnect the personal account and retain control over it when notified seems like exactly the sort of thing the regulators ought to be doing. This is such a flagrantly inappropriate policy that some sort of punitive fines to make an example don't seem out of the question.