I’m suspicious that what they’re saying is true. If so, a simple curl to the site would be all that is needed without running a full speed test.

It’d be great if they could be more methodical and track down what’s really going on. I’d also wouldn’t be surprised to see an ISP doing something like this, but at the same time, it’s much more likely to be networking issues on the consumer’s side than a malicious ISP imho.