that is wrong!
our group did around 5000+ boosts since MoP in Cm boost runs, and we never had to receive secret answer.
just tell the customer:
a) get authenticator app
b) if a) is not viable, then the customer just gets 1 email, whenever you try to login, that " some1 logged in and they have to reset pw and ... ".
then just reset pw and give the new pw to you guys = GG
c) have the authenticator thingy from the good' ol days.
true that, u dont have to use bots to complete CM boosts ^^ bots sometimes play even worst, cuz sometimes you have to "safe" cooldowns for 1 specific pack, and that doesnt know the bot
another thing is:
the ip change does NOT matter, since you are free to use a VPN to play wow, its NOT against the ToS to change IPs in seconds, just "authenticate" it, using a)b)c) and thats it.
none of our 5000+ customers got banned from using our services...