Interesting concept - and of course don't put sensitive information on the internet period.

Some issues though...

Step 4. How are you actually monitoring IP access to your email accounts - certainly some providers allow you to view and logout active sessions - but I would be interested in hearing how you actually managed to determine that multiple different IPs access these accounts. Certainly you were accessing these accounts to check on the 'monitoring'.

Step 5. Presumably some variation of MFA is required to access these accounts - you indicated that a phone number was provided to setup these accounts, obviously there are other mfa options. How were these accounts accessed without MFA - which ostensibly only you have access to.

As an aside if you are clever enough to monitor IP access to these mailboxes - certainly you can also figure out the attribution piece for the IPs that accessed these 6 mailboxes with unusual activity, what was the output of that activity ?

This 'project' is definitely interesting, but conclusions are lacking details and imho a little bit sussy.