That's a simplification of what was happening. It was a combination of indicators that they list:
- A large increase in number of nodes
- All nodes using 100% of CPU
- AND a lack of payment history
I'm merely saying that the lack of payment history is an important indicator of suspicious activity. 100% usage by-itself was not the primary indicator that their article discusses.
Using what you've rightfully obtained shouldn't be regarded with suspicion.