So sorry to hear what's happened, it sounds like the worst nightmare imaginable. This part particularly made me roll my eyes:
"I can’t even sign out of the blocked iCloud account because… it’s barred from the sign-out API, as far as I can tell."
FFS. That is terrible API design...