The sending of malware part might be to get files served from a somewhat more trusted (and less likely to be blocked) domain. No matter how many files you sent

The sending of malware part might be to get files served from a somewhat more trusted (and less likely to be blocked) domain. No matter how many files you sent through it, it was much less likely to get blocked at the DNS level by Quad9, OpenDNS, DNSFilter, etc. than some random compromised website. There's also a real incentive to having files retrievable only once, because if someone downloads the file and AV kills it, that email can't be passed along to someone so they can get their own clean copy for analysis. As for how to identify it, because files were being encrypted before sending that probably was being done by seeing how much the service ended up in spam/phishing attempts - they may well have been able to get that information from filtering software vendors.