How to temporarily suspend iTunes Connect payments for app earnings

Since you have shipping apps in the store, you will be able to call developer relations and begin the process to get things reset.

https://developer.apple.com/contact/ and https://developer.apple.com/contact/phone.php

Even consumer Apple ID have the ability to set a separate email address for emails about resetting the security questions and emailing administrative changes, so the account in question might very well be set up in that manner.

While you are on the line, you can ask about setting up multiple accounts for your business so that several people are listed to do certain tasks for you.

They are correct, a user on iTunes Connect has access to all apps, no matter what their role. Obviously this is a terrible design, but Apple has never been too quick to fix design flaws in iTunes Connect.

As you mentioned appFigures has the ability to restrict a sub-user's access to individual apps. The publisher will have to set up the primary account.

I can't find official information from any of the other analytics providers that they have this capability. My App Annie account definitely does not.