Abuse signals

An hourly check looks for three patterns:

• Redemption spike: one code redeemed in 24 hours far more often than its recent average (4 times by default, with at least 10 redemptions). This can mean the code leaked.
• Possible leak: more than a set share (60% by default) of a public code’s recent redemptions come from first-time customers.
• Multiple accounts: the same customer IP or shipping address appears across several billing emails on a code limited per customer.

These are flags, not blocks. Store Steward never stops a customer at checkout. Ticking “Ignore loyalty and reward-plugin coupon codes” keeps per-customer reward codes (such as those from SmartCouponX) out of spike alerts.