When dealing with situations that involve hacking, scripting, or other "exploits" for a lack of better words, Staff is always required to have at least two other Staff Members (admin+) support the claim. That means at least three or more Staff Members has agreed upon suspicious activity; however, some sort of evidence should have been taken down at the time (demo, screen cap) in addition to the support of two other Staff members witnessing the suspicious activity.
With that said, I'll assume that there was no demo or screenshot taken (correct me if I'm wrong). Although, given that a Division Leader agreed upon this ban then I believe it was justified in that this particular instance required no substantial hard proof if the Division Leader witnessed it first hand, but that's just my opinion.