Just a guess but . . .
. . . as I see it, the only way that Twitter's system can notice 'suspicious activity' is if tweets from the same user keep arriving from different IP addresses.
At one time tweets would only arrive from the IP address associated with a Twitter user's phone provider or, if he had his phone set to automatically connect to his wifi when at home, from the IP address of his home router.
These days many people have their phones configured to automatically connect to their work wifi and to the free wifi provided by Wetherspoon's, Tesco's, Sainsbury's, Barclays, Costa, Transport for London, National Rail and countless other providers. If a Twitter user keeps moving around (while sending tweets) his IP address will keep changing, possibly causing Twitter's system to see the activity as 'suspicious'.
Just a guess though!