It sounds GDPR legal. After all, they are telling you exactly what will happen with anything that you send there, so by sending it there in full knowledge, you are essentially consenting to that processing of your data.
Also, German courts have ruled that in-between service providers are only liable for taking action after the complainant has raised the issue with the party that is directly violating the rights of the complainant, or their hosting provider and those efforts have proven futile or can be objectively deemed to be futile from the outset.
And finally, who says their customers are the abusers? In many cases, their customers may be the victims as well, without their knowledge, for example due to compromised CMS and would indeed be the best person to address the issue you may want to see resolved.
