Basic sysadmin monitoring techniques from twenty years ago would have worked too.

> part of the answer is obviously "it's hard to have a classifier that smart" and "it'll have false positives" but even a very bad safeguard would have stopped this.

And maybe "they are running after glory, not safety"?