They might have some automated system that does it. With the amount of money going around and the ease of deploying such a technology (single digit false positives don't really matter to the modern megacorp) I'd somewhat expect it to be standard right now.

The really gross but unsurprising part is their sheer unwillingness to talk about this instance and actually work with the customer to clear things up.