Behavioral analytics for detecting trusted service abuse