Overthinking what Bliz did?

I was looking through their API's that people are encouraged to use to create addons, and there are a few that wouldn't be hard to write a script to analyze the data from with a simple Python code. I am willing to bet this was the route Bliz took, gather all the records between a certain time for a certain zone and have the script find all the ones that have specific similarities. It is such a simple approach that seems to simple to be true, but they could do this to multiple areas in minutes. Literally the code could be around 10 lines. To avoid any detection from injecting anything, they just run it offline. Any one here could do the same thing if you created a simple addon with their API and logged the data into a database, and is totally legal.

This way would allow them to catch a large amount of people botting, but would inherently catch a few people who did not and were just unfortunate. This would also explain the seemingly randomness to people not being caught.

Any thoughts?