If it ended up in someone's backlog, then MailChimp still screwed up because the "suspend account" button should automatically send a notification (even if it only said that more information will follow).

I'd also add one item to your list: Proper monitoring (which is extremely difficult and time-consuming to set up). A plan B is useful if you know that you need to enact it. Here, the third party provider had silently caused an outage, possibly because they consider shadow bans more effective without considering that the same thing that makes them effective makes them extremely damaging when they're handed out incorrectly.

Good point! Monitoring is also one of those critical things one should always have.