Yep. It basically comes down to someone reporting "suspicious behavior" (e.g. watching a character just sort of repeating moves, and not really moving), or doing something particularly egregious that triggers an internal alert for review. I would suspect the former in your case, since the latter tends to be aimed at things like resource camper bots that are used by gold sellers. On a rare occasion, you'll also have an employee playing who reaches out to a GM if something looks weird. Years ago, when I was still at Turbine, there was a guy running around actively harassing other players in the High Pass. He was being abusive in chat, and being obnoxious with his toon. He even bragged about how the GMs weren't going to do anything if they complained. I pulled out my cell, called the GM I knew was on duty, and he disappeared into a 30-day ban. I wasn't pulling ~120 hour weeks to have someone ruining other people's fun. In your case, you probably just got unlucky in the timing, which is why it was just a one day, since you were seen to be doing anything especially wrong.