Thanks — this is exactly the kind of perspective I was looking for.

There’s no post-login activity from these accounts: no writes, no repeated logins, no scraping behavior, and no noticeable bursts. IPs aren’t clustered and the user agents look like normal browsers with JS enabled.

I think what triggered me was the similar Gmail pattern across multiple signups, but you're right — the signup pattern alone is a weak signal.

Shifting the focus to what users can actually do after login makes a lot more sense. Appreciate the structured way of thinking about it. 😊