There's not enough info in here to know how Google was involved if he sent the emails from Proton. Proton absolutely does not cotton to illegal shit, and actionable threats would be up there with LEO compliance.
My guess is he was on a VPN and had logins from a Proton account, validated with a burner phone he kept, and was also logging on to a personal Gmail or using some Google service that identifies him while in the same VPN location. Proton and the VPN give up an IP address that corroborates to what Big G tracks to him.
Edit: even a no-log VPN would likely be compelled to confirm a user at an IP address at a certain time. That's not a a "log" per se...
Idiot should have known to change his VPN location between instances and/or use TOR like a big boy, but mental health issues seem to be there driving force, not rationality.
She should be paying in Euro then. Never know when the USD is going to collapse.