Instead of trying to fix the key system, or implement extra methods of authentication, they decided to distrust authenticated users if their accounts were acting suspiciously.