The key point here is that it's impossible to travel long distances in a short amount of time... Of course people travel. What's not normal is to log in in Miami and in the next minute log in Seattle....
The key, imo, is 'normal'. A new account has no activity, but an account that has, say, 3 years of only ever logging in from IPs located in, say, Detroit area suddenly has logins from Europe and attempts to change email/pass/etc while activity is still coming from Detroit - that's an anomaly. But until there's historical data to compare against, you can't really know. And... unless you've got a lot of computing power to check for that all the time (or outsource that sort of stuff), you probably can't detect that.