I was under that impression for many years but I was wrong. They probably use algorithmic methods to identify the more suspicious sites to review. They also use spam reports and paid advertising reports.