I'd wager its a bit suspicious that an account has connection times for n + 1 accounts all deriving from the same IP range. I think that's an obvious marker point.
I'd also wager that Bot behaviour is much easier to spot than folks think not just from a data reporting perspective but even in game. For example, its painfully obvious to watch a bot in-game.
Signs like:
- When the Raid Boss / Dungeon bosses "move" the bots are extra quick to match the sequence. Think that most humans have a latency in reaction time, bots are instant. I watched a Raid last night and I just laughed at how easily i spotted it and thought "must randmize that reaction time more'/
- When a bot is doing grinds / quests etc its not only obvious they tend to follow the same "paths" but also when a mob gets within agro range or even a hint of agro range, they react often BEFORE the mob has... for example a bot running in a straight line happens to just walk past a mob, reacts, kills it and then returns to that line... I shadowed a bot once to observe this and also noted at the obvious visual signs it projects.
- Players aren't exactly "Observant". The assumption is sometimes you do something obvious, other player see's it, reports it and thats a trigger. Imho I'd wager if another Player sees you steal their kill or something along those lines, they in turn just "tell on you" as payback. Lets assume Blizzard then follows up on any and all reports regardless of the merits, at this point they run their data report validatation checks and sure enough it would likely trigger a "suspicion and/or confirmation".
My thinking overall is to the "why" is that when you're not being Observed it's free and clear. The moment they cast an eye on your account the data footprints alone would give you away and even if that doesn't often just the actual visual behaviours leave markers. Overall, the only real saving grace you have is not drawing attention to your account - brand new accounts with more than 1+ IP connections for multi-hours in the same "xyz" zones.... that's a pretty simplistic report to "BEGIN" a diganostics check with. I think that triggers the "observation" protocols at the very least and then its a process of elimination.