I work for a cloud provider (not hetzner), and sorry, but this is normal behaviour for them.
Every infrastructure is based on the principle that nobody will use all of their ability at the same time. Road network? Good luck with a whole city in their cars at the exact same time. Power distribution? Tell that to the british grid when all of britain turns on their kettles at the same time during sports events (live broadcasts are out of phase from regions to the next to alleviate this issue). Or to their sewage system, where all toilets flush at the same time once the human byproduct of said kettles is produced.
So yes, this is a hosting provider where the bandwidth is shared, they overcommit it, otherwise they would not be able to do them for that cheap (in case of hetzner), or at all at a profit (for other providers that are not bottom-end). Here they tell it is unlimited, because there is no data cap. The same goes for virtual machines in a cloud environment, those too are overcommitted, and I can guarantee you that if you spawn AWS instances and use 80% flat of CPU 24/7/365 you'll get the same kind of email directing you to the cpu dedicated instances.
Actually, they even did you a favor for not kicking you out due to "trust and safety" flagging you as fraud (like sending spam or ddos, which they 100% should have btw).