Did they consolidate your coins to their own address, or did they return it directly from the address you deposited to?
Who determines this "risk score"? I'd say this just confirms the "risk score" is mostly arbitrary.
First, they asked me for a new Bitcoin address, because their system does not allow them to send to the original one from which I sent coins, because it is "compromised". In a short analysis, I did not find a connection between the 'dirty' coins that I sent and those that I received in return.
They use Elliptic to check the 'risk score'. As far as I understood them, it is a tool used by service partners, where they forward/sell coins.