I see you already added this edit just now but yeah it seemed kind of fishy they would do this. The whole idea that you'd verify yourself with a mail address in user agent doesn't make sense, like I could just add [email protected] to my user-agent since there's no verification.

I often see organisations that blacklist curl, just using User-Agent:Mozilla/ is often enough to bypass it.