And how would Twitter know which API key somesitewithtweets.com is using? There are ways, but if the API key user is careful and doesn't allow arbitrary searche

And how would Twitter know which API key somesitewithtweets.com is using? There are ways, but if the API key user is careful and doesn't allow arbitrary searches (so Twitter can't try searching #someguid and then kill that account) it'd be pretty hard for them to figure it out. They could try adding fake deleted tweets on a per-account basis, then seeing who publishes those. A simple two-account double check or manual intervention would prevent that from leaking info.