A workaround is to set up a desktop email client - allow it to fully sync, then use the desktop email client to export your email and import to another account.
Google rate limiting and restricting access to your own data is pretty awful. They are similarly terrible about OAuth permissions for 3rd parties - some companies are allowed to export data on behalf of customers while others are not.
Elsewhere in the thread gsreenivas mentions that the solution is too expensive for spammers and so they haven't had a problem with that yet, so we've actually moved to the original solution to spam: charge for sending e-mail*. The original proposal was to charge per email but an annual subscription would have the same effect in the right market (for now.)
Strictly, that's dynamic IPs. The Venn diagram may almost be circular, but not quite. Part of the point being that it's much easier to block static IPs, while a spammer on a dynamic IP will evade any blocks when their IP address changes.
My in-laws outbound email broke recently because, being on a dynamic IP, they'd been set up to send through their ISP's smarthost. Then they changed ISP :P.
This is even missing a trick: unless its politically indicated, AWS does not ban its customers for spamming, high-rate crawling or other abuses, causing its IP ranges to be widely blocked.
So now Amazon gets to market segment and sells a trusted email service, too!
Great questions:
> - How to ensure the hardware is not chipped with some low level spyware?
We use a verified boot process to ensure trusted bits are running on the HW.
> - Can we install stuff on this machine? How is the upgrade process working? Do we have root on the machine if need be?
Not yet - but we are planning for customers to be able to run their own services in the future. We have quite a few updates to do before we get there. The upgrades happen OTA, seamlessly in the background. There is no root access on the machine locally or remotely.