I'm going to make a guess here from my own unrelated experience trying to debug problems in live systems. It is often much easier to detect that there is _some_

I'm going to make a guess here from my own unrelated experience trying to debug problems in live systems. It is often much easier to detect that there is _some_ unusual activity present than it is to categorically define exactly which activity is legitimate versus which isn't. Usually, this is because you can easily detect some of the anomalous behavior but not all of it. So you'll have some activity which is obviously anomalous, some which is obviously legitimate, and some which could be either. And sometimes when you've detected some that are obviously anomalous, most of the rest of the activity ends up being in the category of "could be either" with almost none left in the obviously legitimate. So from Google's point of view, I'm sure they ban the account so that they 1) don't end up paying a lot of money to users for the "could be either" activity, and 2) don't need to keep expending server resources continuously categorizing and serving the obviously anomalous traffic.