Seems like the simplest defense against this would be to use a moving average to base the withdraw limits off.