in comments to the original blog post, the PM for this feature mentions that the "my friend's been hacked" reports aren't enough by themselves to trigger this,

in comments to the original blog post, the PM for this feature mentions that the "my friend's been hacked" reports aren't enough by themselves to trigger this, they have to be accompanied by suspicious usage patterns on the alleged hacked account.