What i take from this is that your personal actions on GitHub and the actions of a bot doing API calls are indistinguishable in their logs, otherwise it would be obvious that those stars have a caller that is not you.
That's the first thing I thought. They should be able to see which actions were taken by the app and undo them when cleaning up the abuse. No need to ban accounts.
