It’s a paid service, so the only way to enforce that unpaid users cannot search is to take a search request and check if it is coming from your account
That’s not the same as logging.
You literally need to associate your requests to an account to make basic functionality like this work.
They just need to check the session of the user on the fly during the search operation. Once the search is done they don’t need to persist any record linking the search and the user.
The management executive who took this decision deserves a punch in the face.