For example, if they detect multiple accounts somehow, they would flag the withdrawal and ask for KYC before they suspend the account.
I just mentioned one possible reason/criterion. Other possible reasons could flag a withdrawal for manual verification. As for spinly, they approve withdrawal manually regardless of the withdrawal size. Of course, they have some limitations, which is why the withdrawal is manual. But they will change it in the future.
The example you give is very good and appropriate and it is the way to understand how a casino can act in the face of all this, Cases like this have occurred In fact, sometimes it is not even the person's fault, because it may be that a person enters the casino and his uncle, his father, his brother and sister, his wife want to enter the casino to play, and they are all different accounts but with the same public IP That's where things can get complicated. I think that is the point of KYC at that time and it can be determined that it is not an exploit.