I think it’s important to be rigorous and even handed in calculating these fines. Part of that is identifying precisely what action(s) are being called out, and how the fine is calculated. I disagree with many of the EU fines, but I do think they are fairly methodical about how they calculate the amounts. ‘We don’t like you, and you do lots of other bad stuff’ is not a valid methodology.
Repeat offender certainly is justification for multiplying the fine, but at this point in this particular case that’s jumping the gun.
In the case of verifying a user’s email by asking them for their password, that seems to have been an egregious mistake that was quickly rectified once it was called out, and although certainly they could have used that access to pilfer contacts (and a whole host of other personal info) I don’t believe anyone has claimed they actually did that, and they said definitively that they did not. For what that’s worth.
They trick users to give them their email password, then use that password to login and steal all your contacts.
That one that should probably be criminally charged.