I've seen some people over the years that I've been using mullvad complain that their accounts got compromised.
And since Mullvad is in the business of operating without collecting any data on their users, there's no way to stop someone from mooching off your account once they know your number.
I'm suggesting that every mullvad account should have the option to have a password on the account as well as the account number. No email addresses, just the account number and a password. Pretty much every mullvad user is also using a password manager of some sort. So adding that extra security option I think would be greatly appricated by your users.
You would need to update the website log in functions and you'd need to update the way users log in to the VPN app as well, but again, your users would be happy to have this option if they want it.
You already have to keep track of how much time each account number has left of it, it wouldn't be much more to keep the password too.