This is a completely different thing than someone using the protocol in a valid way, but for nefarious purposes. To take yesterday's example: it's not the "protocol action" (sending ETH) that was "wrong", it was the destination ETH address.