Detect Anomalous User Event Bursts

Problem

Given a list of user activity events events, where each event is a pair [user_id, timestamp], and two integers window_size and max_events, write a function that returns all user_id values that are anomalous. A user is anomalous if they perform more than max_events events within any inclusive time window of length window_size. Return the flagged user IDs in sorted order.

Constraints

• 1 <= len(events) <= 10^5
• events[i] = [user_id, timestamp]
• user_id is a non-empty string of length at most 20
• 0 <= timestamp <= 10^9
• 1 <= window_size <= 10^9
• 0 <= max_events <= 10^5