I work for large host here is my take on this<p>1) They shut down my servers and suspended my account without notifying me.
If your server is doing 1Gbs outbound I would expect them to shut it down ASAP for many reasons. Likely a more senior person detected the issue and shut down the server, then passed it on to 1st line support to contact you.<p>2)After contacting them, they immediately accused me of "launching an attack from their platform".
You launched an attack vs a sever you are responsible for launched the attack, it's semantics but the support agent could certainly have worded it better, but not a big deal in my view.<p>3)After they performed their "investigation", they refused to give me any details and kept my account locked and servers offline.
The investigation probably wasn't any more than their networks team detecting very high outbound traffic originating from your VPS IP that was clearly malicious. In that case the only explanations are that you are deliberately breaking their terms or your server is compromised, there is nothing else to discuss. They should really have sent you some standard text helping realise the reality of the situation but it wouldn't have hanged anything.<p>4)They refused to give me a copy of my data which delayed getting it hosted elsewhere (had to get ssl certs reissued etc).
This is not great but if your server is compromised you have to accept that you will need to work from backups. First line support probably don't have a way of getting the data without starting the machine which they can't do in the circumstances. I'm sure one of their sysadmins could mount the virtual machine as a disk image to get the data for you, but that's not part of the service they offer or you're paying for. They can probably get your data given time and/or if you pay them but it's not reasonable for them to do this as a priority, especially as they are a budget host.