If they could get into the recovery email, yeah, they could get into his Proton account. Also useful just for confirming the ID of the person in question.

I think in this context “disposable” means “this free email address is now blocked, and there is no bar to simply creating another account for continued spamming”.

If the list includes Gmail for this, I don’t think there’s a sound argument for excluding Proton.