Ransomware crook's email provider shuts down account, so now no one can pay their ransom

Negligence doesn’t require a contractual relationship, just a duty of care; you can be negligent toward complete strangers. A criminal who engages in an intentional act, by definition, can’t be negligent. I agree negligence is a long shot, but it’s not categorically dismissable.