It took almost 4 months to get through to someone who would accept my problem wasn't forgetting my password.
In the end, I was pointed to their third provider and told "sort it out yourself, not our problem". Thankfully that other company had a reasonable-ish appeals process...
...obviously I got relisted in their db a few times but things seem to have calmed down now.
Instead of designing our systems as though they all face the hostile public Internet like Google, why not instead police all of the public Internet as though it's our internal network? That way we don't need to adopt any actual security practices. What could go wrong?
As you saw, basically everything, all the time.
I actually moved energy supplier a few months ago. I had a good quote from a new supplier, and when I tried to sign in to see how close the quote from my old supplier was their site wouldn't load in my browser, tried again a day later, no joy. OK cool, bye then.
Surprisingly, Amazon does not block customers they put on this list.
Fortunately, since I build multi-lingual web sites, I was able to get an exemption from the security department.
(No, I don't use Google Translate to translate web sites. The company has three internal and two external professional translators for that. But sometimes when I'm copying-and-pasting between versions, I like a little reassurance that what I'm pasting is what I think it is.)
Currently however, providers are bound by EU mandates to treat every packet the same (roughly speaking).
I hope it stays that way.
[1] - https://www.techradar.com/uk/news/ofcom-to-review-uks-net-ne...
The annoying thing is not the false positives: these things happen, and mostly it's not all that urgent to resolve immediately. The annoying thing is a total lack of obvious appeals process to resolve a false positive. At least the OP's example is on GitHub and thus can easily be issued.