I don't know why memory scanning came into this as it seemed pretty obvious from what the GM said about observing logs that repetitive behavior was witnessed to a degree that simply doubts human involvement. Something like running into a wall for hours while farming mobs for example reads back in logs as very unnatural movement and activity. It starts to smell like botting. Even if you're just manually auto running into a wall / corner. The GM may not even go to the location but look at movement logs to see.

There are loads of ways to determine something is inhuman beyond sniffing at memory.