Obviously this is going to vary per jurisdiction, but in the US this is plainly wrong. The burden is on the party asserting a debt to prove that the debt is legitimate. If Hetzner wished to enforce the debt, they would have to go to court and substantiate that their contract was really entered into with OP.

Instead they're just extrajudicially screwing with him, likely due to organizational incompetence - nobody was empowered to evaluate the situation with human judgement. Legally they can do this, as they can choose to not do business with anyone they'd like. But potential customers are free to judge the poor handling of this situation as a real risk, and avoid relying on Hetzner too much.