You have a certain "budget" for losses like this. Beneath a certain amount, you just take the loss, as it's more cost effective than spending man-hours on it. Their fraud systems and dedicated fraud teams are better off alerting on the "whales", so to speak. And in these cases, if you're gonna lay accusations and ban people, you'd rather be more certain (i.e. minimize false positives).

All that is to say, it's understandable if they only pounce once it gets to a certain level of badness.