As MoneyBroz said, this behavior is by design. If the system is unable to verify that a domain is actually hosted with us, it is disabled to conserve resources.
Domains are considered to be hosted with us if:
Their A or AAAA record points to our server IP.
Their MX is pointed to our server IP.
For domains using Cloudflare, they can be validated via DNS if proxy is disabled, or by checking if a challenge file placed on the account by the verification system is reachable via your domain (which proves that the origin is set to us on CF), if the proxy function is used.
Note if you use our server for email only, you need to actually put tommy.heliohost.org as the MX for it to validate (email forwarder/mail server proxies are not supported).
Since you use cloudflare, you need to make sure that your origin is actually set to our servers, and that the WAF is not set to with rules that could block traffic from our server (e.g. a geo-restriction that blocks the USA would cause validation to fail).
Your domains are on CF, have an email forwarding service, and the websites worked for me while disabled in Plesk (which indicates they aren't hosted here), so they are being correctly disabled.
I did enable them again for you, but you'll need to actually make one of the changes above to keep them active.