You have to confirm a suggested bank rule before it is created. So I'm not really understanding how this is happening all the time for you unless you (or your client) are "quick-clicking" and accidentally confirming the creation of suggested rules.