Might be relevant…
Someone please correctly me if I’m wrong, but I believe…
There are some checks to see if an “admin” IP address has been used to create an account.
If the new account is created by an IP address shared with an “admin” this is not flagged as “Suspect”.
Might have an higher impact if both admin and users are logging in from the same IP, e.g. a University internet connection