Every export is automatically checked against a set of suspicious-pattern reasons, and any that match are emailed out (to [email protected] plus any extra addresses configured for your account) without blocking the download itself:

• First export — this account has never exported before.
• Large export — at or above a configurable row threshold (default 1,000).
• Full table — the export is roughly the whole list (≥90% of what's available and ≥200 rows) — the shape of taking a copy rather than looking something up.
• Daily volume — this account's total exported rows today crosses a configurable threshold (default 5,000).
• Rapid sequence — several exports run within a 10-minute window (default 3), the pattern of a script paging through data.
• Out of hours — the export happened outside the configured normal working hours (default 6am-10pm).

Only an export that also crosses the account's hard daily row cap (off by default) is actually blocked; everything else is allowed through and just recorded/alerted.