"The core of the controversy stems from Proton Mail providing the Spanish police with the recovery email address associated with the Proton Mail account
[...]
Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual."

like any service they can be forced by law to hand over user data they store (just like signal). adding a recovery email is obviously part of that but they should be more transparent about the data (like signal). last time it was only IP and device type....

https://web.archive.org/web/20240507094129/https://restoreprivacy.com/protonmail-discloses-user-data-leading-to-arrest-in-spain/