I have no idea how the resellers are doing it but an obvious starting point would be a cheap VPS node that routed each account to a unique semi-permanent IPv4 or IPv6/64. All the provider would see would be a regular account making a normal looking stream of requests from a stable datacenter IP address. Any given request stream would remain consistent (at least over a period of a few hours) because a reseller would take care not to split the session of a single user across multiple different accounts and not to interleave the active sessions of multiple users on a single account.
Detecting this would be extremely difficult because on a longer time frame it's perfectly normal for many distinct accounts to work on the same code base.
You block clouds, you block devboxes and your customers.
Or is the datacenter IP just one part of the picture?
There's a lot of inauthentic coordinated automated systems these days along the general lines of scraping/crawling/social media manipulation/sockpuppetry that require running through residential proxies or proxies to places that don't look like datacenter IP space.