I've always had the theory that they have insiders or... tinfoil hat... they reverse engineered the bots or parts of the bot. When they run the game they are doing warden scans that see the code, not the repetitive movements... thus why in their EULA it says they can scan other regions of memory besides the client itself. This is why they don't reveal they actually do it because they would be sued so bad they wouldn't be able to sleep at night. Thus why ban "investigations" are internal only and the user never really knows why they EXACTLY got banned.
Is funny with bg botting indeed, I've been botting on few of my WoD account for 2 months STRAIGHT 24/7 - I wanted to gear fast to progress with some garrison shiet. after just 3 hours, 72 hour ban.