The only thing I’d note is to be careful with your issue #2, because this sounds like it could break with autofill. Some autofill implementations may fill invisible fields (this has actually been an attack vector to steal personal info), so blocking the IP because an invisible field labeled “email” has been filled could hit users too. Otherwise, 100% agree!
I’m not sure if this is how proton notifies you, but it could also be that someone else (the other address you’re seeing) put you in as their recovery mail. they haven’t logged in in a while, and now get notified that their account might get deleted due to lack of activity. They might have just mistyped the intended recovery email or randomly put in yours. Either way, nothing you need to do.