This needs care, but I don't see why they can't just rate limit key activity from high risk accounts that are reported, then let the person carry on. If they're genuine then things like friend requests will get accepted but if they're fake, those will get a poor response and seal their fate.

Simple: earn trust through good behaviour. And it's not too heavy handed for the false positives.