We tried 0.8.1 and it didn't trigger a ban. We also go a list of all DLLs loaded into the ET process, and there weren't any that seemed suspicious to me (i.e. unsigned).
Interestingly, whatever software is causing this is apparently triggered by the filename, which is also why ET Legacy worked. When we renamed the stock ET binary it worked fine as well. So we also checked two programs (mouse, gpu) that allow creation of process specific profiles, but neither seemed to be the cause.
I'm now trying to compare memory dumps trying to find the parts that are being modified, though I probably haven't worked enough with this kind of low-level stuff to find something useful. If you have any other tips on how to track down this I'd very much appreciate it.