You have the full support of the community.
It has already been suggested here that you should use more than one address and thus make it difficult for them to try to discredit the eXch service. I wouldn't give them a single day, let alone 90.
Ninety days I believe to be the legal minimum for this type of requests.
For the rest, it will be really relevant to take measures to protect a legal business.