Things have been resolved and we are still on the original server.

We suffered a little downtime but all good at the end of the day.

In communications with them, the operations manager emailed me and within is the best explanation:

I'm sorry for the confusion here and also for not updating your ticket sooner, I meant to reply once I saw your compute order and issued that refund as I figured there'd be some confusion from your side with what's going on.

Our team made a mistake and accidentally suspended your site as the target of an attack when it was just a false-positive from our monitoring systems, and there was no DDoS/DOS towards your domain or services. You should not have been suspended or prompted to upgrade to a compute. That is entirely our fault for misclassifying this activity and causing you a suspension/downtime when none should have been incurred.
Shit happens and I of all people know that very well. Everything was reversed and he gave me a free month of hosting - which IMO was totally unnecessary, as things are completely fixed within 12 hours, and really wasn't a major mistake considering the false-positive that occurred.

But THAT is how a quality company handles any issues. I had already paid for the upgrade and was going to be satisfied with what had to be done, considering the supposed attack. I didn't point it out to anyone, they just noticed and reversed my charges and told me what happened and apologized.

Double thumbs up to them from me!