The sending of malware part might be to get files served from a somewhat more trusted (and less likely to be blocked) domain. No matter how many files you sent through it, it was much less likely to get blocked at the DNS level by Quad9, OpenDNS, DNSFilter, etc. than some random compromised website. There's also a real incentive to having files retrievable only once, because if someone downloads the file and AV kills it, that email can't be passed along to someone so they can get their own clean copy for analysis.

As for how to identify it, because files were being encrypted before sending that probably was being done by seeing how much the service ended up in spam/phishing attempts - they may well have been able to get that information from filtering software vendors.

It's very common for malware to use services like this:

1) To host secondary payloads

2) To exfiltrate user data

3) In some cases even to coordinate commands to payloads

I didn't think about exfiltration - good point. I guess they could just host their own instance on <insert compromised server here> like the good old days.

Malware authors like nice APIs, just like devs do. They love when it's really nice and simple to just push some data to a storage service.