Paragraph 1 shall not apply if the decision: is necessary for entering into, or performance of, a contract between the data subject and a data controller; is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or is based on the data subject’s explicit consent.

If you send abusive texts through Twilio, Twilio could lose it's contracts with carriers. I haven't read through the paperwork Twilio makes you sign, but I'm gonna guess the fact that this could happen is in there. Also it sounds like the account wasn't banned, it's ability to send messages was suspended. Because it was being used to send spam text messages. I'm pretty thankful Twilio has automated systems for that

This is absolutely not applicable even if both parties were in the EU, a company can not be a data subject under GDPR (only "natural persons" are), any GDPR clauses about automated decisions (and others) protect only individuals and not B2B accounts.

GDPR can only be enforced for citizens in the EU/EEA and (for now) the UK. I think the OP is based in the US as is Twilio.

Thats right, we're in the US

Nitpick: The GDPR says it applies to persons who are "in the Union", which seems it would cover non-citizens who reside in (or are even just visiting) the EU, and would not cover EU citizens who are not in the Union.

Yeah, re-reading I should have used "persons" rather than "citizens"; was playing a fast and loose with the meaning of "citizen" and didn't actually mean a "citizen of".