Hi Mark,
We do allow teachers to enroll students. This particular situation occurred when a teacher restored a course with user data included. The students from the old course were enrolled in the new course. At some point their student role was removed, but their account was not suspended. As a result, our query didn't find these students and automatically suspend them.
Our thought was to modify our query to identify students that did not have a role applied in addition to those that did, in order to prevent this from happening in the future. The only way we could see to do this is to join contextID and instanceID without using mdl_role_assignments.
Thanks