I don't follow. They can't tell if their terms of service have been violated so they took CERT's word for it? How did they decide to restore two accounts then?

there are ways to demonstrably violate terms of service without having access to a user's unencrypted data