That’s the point: a small number of IPs accessing many accounts could become suspicious. (But may not be trivial to distinguish from legitimate usage due to NAT.)