In fact **they never ask for account number** by mail so your assumption that they can remote login  is false. Plus just  don't e-mail them - or use PGP-. This is a low key issue with shouldn't prevent people switching from other VPN or using a VPN at all.