"Someone closed an account with a balance of -5M reward points" might automatically trigger this. Plenty of account closures happen without a human ever seeing it.
The account was brought back to normal well before the termination of all of our accounts.
I also expected them to have automatic triggers, but at the time they did not.
I would generally also suggest incompetence above malice, but above fact makes that very hard.
I would expect a reasonable middle ground of letting employees say "I'm sorry, but it's corporate policy and I can't disclose more information."