Do not forget, that the auth server is tracking your login pattern, and react very good in my opinion:
1. If you usually log from one computer, you will be asked for SA, when u change it.
2. If you usually log from 2-3 computers, they record them does not ask for SA when you log from them in the future, only when you change the common pattern.
3. I am sure, they track the geo location of your login IP address, and lock you out, if you change login from different country or distant location - happen several times to myself.
4. I believe they have database with known-to-them public free and paid V-P-N servers and the IP ranges, assigned to the customers - it is a real scenario for "flagging accounts for review" vs. the-botters-who-use-V-P-N.