As soon as people know HOW they are being caught, they can change just that bit

You fundamentally misunderstand. You have dozens, potentially hundreds of people all abusing the system in different ways. It's not like Apple iOS exploits and the cat and mouse game.

On reddit, there's tons of user account black markets, plus the absolute reality of not even using a middle man, and simply doxxing the popular account and making personal contact.

For Overwatch and Blizzard, there's always new exploits and tools popping up in the forums and the trolls are trying out lots of things on their account cavalierly.

The point of ban waves is that you don't immediately show response to any one specific vector. The people who are banned may have tried several things, and have no way of knowing which vector is compromised.

In your scenario, offenders would have to discard all their vectors when just 1 is caught, not knowing which site or which exploit, or which <insert valid metaphor object> was found.

Was it that site the account was listed on? Was is someone that direct messaged them? Are they using spooky machine learning and giving it the entire user data set and developing a heuristic which can determine when accounts are being used by multiple parties or traded? Who knows.