Microsoft can revoke service for any reason, so it’s legal. Yes, this is exactly how it is done internally. The only way to bypass Mojang’s blocking is to run a “Cracked” server, where accounts are never checked, but in that system anyone can log on as any name.)