It's not that simple. The more data points there are, the stricter the rules can get. A user having an average data upload of 500MB/week would be flagged at 50 MB in 5 minutes. I expect that the system self-adapts until it flags at least some users and I expect those flagged are not the technologically challenged users that browse anywhere and click anything, but the most competent users that perform "weird" actions such as ping, ftp, open the command prompt, etc.