Say you made 100 legitimate claims (you were delayed 100 times), but managed to mix up 2 or 3 so that the dates were transposed with days you didn't travel or a delay didn't occur. GA identify those as suspicious claims, and then send a letter out saying they have detected a suspicious pattern from you for some of your claims. Pay up the full amount of the 100 or we'll report you to the fraud squad. They don't say what claims, they don't say how many, just that 'some' of your 'more than average' claims look suspicious and you give everything back, plus a fee, to make this go away.
You don't seem to have the option to fix the incorrect claims (past the cut-off period, too) or have any way to get more details, and as the claims were accepted you have no real evidence saved from that far back. It's a shake-down.
And if it went to court, it could easily go against you. GA can prove 2 of your claims are fraudulent, which casts doubt on the others. You've claimed more than the 'average' GA commuter and you have no evidence of your journeys. A good lawyer might be able to argue that 2 out of 100 is a fairly acceptable error ratio for a data entry task, or that it isn't reasonable to expect people to keep exact timings of a daily commute, but it isn't a guaranteed victory. A really good (expensive) lawyer might even be able to pick apart the GA calculation of their 'average'. It might be that most people don't register when claiming, so they have 1 claim per 'person', vs the defendant who registered because they have a season ticket or needed to make multiple claims. But again, no guarantee of victory, only that it's going to cost a lot of money.
So you settle, because what is £1k when you could be talking a conviction, fine, criminal record, stress, time taken up and possibly losing your job.