There are many things that can flag an account for "possible fraudulent activity".
Anything out of pattern can trigger it. "Out of pattern" isn't limited to charging in countries other than your residence.
And it might one of the merchants who is "out of pattern", not you.

"Fraudulent activity" used to mean "stolen card". In today's world it's more likely to mean "stolen identity". Thus the "24 questions" game to try and confirm they were indeed talking to you, not a fraudster.

The "auto generated" e-mail is just another confirmation that they weren't talking to a fraudster at the time, assuming that they haven't recently recorded a change in your e-mail address.

Yea, it protects the credit card companies and merchants from losses. But the customer is also getting some protection, particularly in cases where the transaction in question ended up being the customer's first clue that their identity had been breached.

A pain indeed. But sadly, a needed pain in today's reality.