My guess is that the system that does this is completely automated. The number of API calls his app was making set off a flag for spam/spammer and his account

My guess is that the system that does this is completely automated. The number of API calls his app was making set off a flag for spam/spammer and his account was disabled accordingly. Until he contacted them I wonder if any human was even aware that his app had been blocked. The interesting question here is how Facebook will respond in this instance.