Perhaps the billing or perhaps the server is still responding to public remote requests (just not private authenticated administrative ones). Not enough data to form a conclusion, but enough to know things aren’t adding up yet to agree with his conclusion.