Free Web hosts generally restrict functions like that to avoid becoming havens for spammers and other Internet ne'er-do-wells. The reason that it is an option for paid accounts is probably because a paid account has a paper trail that (theoretically) gives the host someone to hold accountable for abuse.

Crooks, of course, simply pay with stolen credit cards and move on to the next service when the payments bounce and the account is closed, but usually go straight for the "big" providers that are less likely to be able to keep close eyes on new accounts instead of abusing a paid tier on a free hosting service. At $WORK, I once had to watch the logs extra-closely around @DAYS of the month. That was when our worst abuse bots changed hosting providers like clockwork for several months in a row. Sending complaints was useless, because by the time the other provider acted on a complaint of a password-guessing bot, the account had usually been closed for using stolen payment details, or at least that was what the other abuse departments told us. I guess the miscreants eventually found easier targets or ran out of providers to abuse, but that wave lasted almost a year.