Before any registrar restores a stolen name - and this happens a lot - they get an indemnification from the party to whom they restore it, and also make sure that party is likely to be good for it.
Secondly, they don't reach that point until they have looked at all of the data available to them and made a decision on the basis of their experience in looking at these sorts of things, and decide "how much of a risk of error is there?". Can they be wrong? Sure. There is always a risk of error, but that's true either way.
Stating "another scenario consistent with the facts" is not a "conclusion" of any kind. I believe I have proposed about three or four so far. And, sure, the facts are also consistent with the sorts of business practices which sometimes strike others as unusual or inappropriate.
You'd be surprised. We had a similar thread at Namepros a while back:
https://www.namepros.com/threads/any-help-domain-name-locked-due-to-pending-tdrp-complaint.1026338/
The OP of that thread
IS the domain thief, and came to Namepros to seek help on how to avoid having the name transferred back. Massive balls of pure titanium, that one.
The reason for doing this sort of thing is to test out different scenarios, have us point out the inconsistencies, and then go back to the drawing board. The accumulated expertise and differing perspectives here provide a valuable test bed for finding the flaws in scams.
The OP uses at least three names I've counted so far, and admits to using a false identity to engage in an escrow transaction. As you note, that could be the sort of usual bumbling around by someone who is not sure what they are doing or how it might be perceived, and can have entirely innocent explanations.
@Grilled the prior registrant of gjfj.com - highlighted on your list - is someone I have advised in the past. I contacted them this morning and they confirmed to me that the name was legitimately sold in September via Namejet. It has passed through at least three other registrants in China since that time. The WHOIS information I posted is historical data from October 18, per next post.