There are two ways that Amazon has figured out the people are downloading (with StreamFab and its clones).
1) Lots of activity online at Prime Video, but no streaming being completed. This has already been discussed, and I think it might just be an initiating step where they decided to search for what was going on.
2) User-Agent Client Hints. Google it. This method provides all the information about the browser/client you are using to contact a server. A simple line called a User-Agent that looks something like this... Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36, was used on Chromium-based browsers previously. Somewhere around Chromium 90, User-Agent Client Hints became the default information transfer method. It provides a lot more information. StreamFab until relatively recently only used the User-Agent that matched the CEF that they use. Now, they seem to have a user-agent switcher that changes the User-Agent once in a while, but does nothing to change the Client Hints. Amazon is obviously using Client Hints to get their information on what browser/client you are using. Try this for yourself, in StreamFab enter the address of https://browserleaks.com/client-hints or better yet, https://www.deviceinfo.me. Amazing, how much they know about your client, aka StreamFab. The Client Hint that stands out to me is the browser - Chromium 135, but it could be anything that they are keying in on. If they see a client with a Chromium 135, they might go back and see how many complete streams of videos you watched. If you are showing 0 or a small amount and yet have a lot of activity online, the email gets sent.
Cats4U
I am sure it could be many things.  But I don't think it's rocket science.  To watch a stream, exhibits very different behavior than does downloading at max speed.  Whether they outsource their CDNs or it's their own department, I am sure they can easily track who does what and the behavior of that client.  I am sure they have logs that go back a year or more.  They can probably run simple reports that points out the vast difference in behavior.  It would stick out like a sore thumb.  I am sure they could also use AI but that's not even needed I don't think.  I run networks, I can do these things on my own networks and I am not a zillion dollar company.
I assume they probably sent out a random smattering of notifications based on some loose requirements.  Could have been Amazon themselves, could have been someone they contracted to handle this based on who owns the CDNs.  I think this was basically a warning shot across the bow.  They probably really don't want to cancel accounts, they lose money that way.  So they are tamping it down and saying, hey stop that.
I would imagine if it slows then they leave it alone.  If it continues I would imagine they get more heavy handed.  Maybe we can go back to a few safe downloads here and there, maybe not.  They have probably chosen this route because it's less of a cost monetarily than changing encryption or making other major changes.  At the end of the day it's all business.
Also, I am sure they read this forum.  Because why would they not.