Generally if you take the approach "what might I be doing wrong?" instead of aggressively asserting "I am doing nothing wrong!", you're able to uncover some solution on your side. I rarely ever try to deal with support because it often ends in no/poor resolutions.

I would guess there's something in this extension that looks very similar to suspicious activity (regardless of whether it is) and some light refactoring would resolve the issue of repeated flagging.

Not suggesting this is right or good, but it's probably less time consuming and more effective than emailing back and forth for two years.