I used the bot slightly, only for taverns and contacts help, once or twice a day (too many clicks, this part is pain).

I have been detected and they permanently banned me and closed my account.

Bad !!!!!

.....

me too.....

It is my understanding that whenever a script utilizes cloneInto, specifically in this .user.js with cloneInto(out, document), that says transfer the script to the sites DOM context which makes it more detectable if they are watching. If the script had stayed in a sandboxed environment (its own context) it is less likely to be detected. While cloneInto is safer from DOM to .user.js engine it doesn't stop the DOM from scouring/detecting whatever is in its own context. i.e. it's a little better than unsafeWindow however not much.

The IIFE here in the script loader appears intact, however the function call in the loaded script appears to send and an empty object. That too could lead to more detections. Which brings me to another point... script loaders aren't always good at keeping privacy all around.