Butsbal?

Sounds like the dev was doing people a favour deleting it from their accounts.

I understand the concerns very well - not going to add more to it.

Just one remark to your distaste to use your email account:
there is always the alternative to use a disposable temporary email platform.
You'll find plenty to choose from.

I know. I have a bunch.
I am running four websites through a webhotel, so I can even cook up an email account for four different URL's very easily.

That's not the point, and I was actually quoting what others have said and adding to it.
The point is, if the initial transaction was between the customer and the bundle provider, and the game activation was between the customer and Steam, the developer is a complete outsider in that.

But in any case the developer is getting some information he is not really supposed to have:
- some people are sending screenshots of their Steam accounts, in which case the developer gets information about those accounts
- some other people are sending receipts from the purchase, in which case there's no way to use an alternate email, at least it would be pointless, as that receipt has the real email address in it

Of course it's always possible to alter the receipt, or alter screenshots with an image editor, but then those aren't real things anymore, so that kind of defeats the purpose of sending anything.

You are right, there is plenty of room for questions in this case.

But:
- is it the fault of the dev, when the given instruction about the needed screenshots are lost on the users?
- is it his fault, when the users don't care for their own security and privacy? Yes, it's indeed absurd when an altered screenshot suffices as proof.

And again: I doubt that this game is worth such efforts; but the underlying procedure is questionable.

An outsider with a window into the activation of their title. In terms of information available to the developers, they also have the ability to actively query Steam to get account info (at the very basic level I assume this is a username and email associated to the account that activated the title the query is related to). This latter bit has been used by some developers to enlist people into mailing lists (this was prior to the GDPR rules rolling out, so I assume doing this now would actively violate them).