I wouldn't be surprised if the anomaly detection is overfit to banned users: comes from Kenya, or Russia, or China. Doesn't initially seed the account with in-person connections. Shares an IPv4 address or telephone number with other folks who have been banned before.