You could try to create a new campaign in the account with the flag ValidationOnly=true.
Doing so will not actually create a campaign, but it will raise an error when the call was not valid.
Note such a request may fail due to different reasons, eg. campaign name is not unique, Google disabled the account for multiple policy violations, the user logged in with a read-only account, etc.etc.
My point: if it fails then you should not report that the account is an express account, instead just report that campaigns appear to be read-only.