Telling people what they did wrong so they can correct it is appropriate. You don't have to tell them how you detected it, and keeping them banned until they fix it is fine.

Also at minimum I'd think I'd allow them access to past emails as a default.