instruction: Look for suspicious upvote patterns in a particular tag. Helps find people benefiting from sock puppet or 'Admirer' upvotes.
  For a particular tag get the Avg and StDev of score - suspicious scores
  are likely to have * BOTH HIGH AVERAGE AND LOW STD DEV * of
  score (e.g. they routinely upvote each of their own posts x times).
  To filter out noise look for > 10 posts and high average
  as persistent cheaters are likely to be... persistent!
  *** NOT AN ABSOLUTE TEST *** - human needs to read some posts and verify.
response: SELECT Users.Id, Users.Id AS "user_link", COUNT(Posts.Id) AS NumPosts, SUM(Posts.Score) AS SumScore, AVG(CAST(Posts.Score AS FLOAT)) AS AvgScore, STDEV(Posts.Score) AS StdDevScore, VAR(Posts.Score) AS VarScore, AVG(CAST(Posts.Score AS FLOAT)) - STDEV(Posts.Score) AS "avg-stdev" FROM Posts INNER JOIN Users ON Posts.OwnerUserId = Users.Id WHERE Posts.PostTypeId = 2 AND Posts.ParentId IN (SELECT Posts.Id FROM Posts INNER JOIN PostTags ON Posts.Id = PostTags.PostId INNER JOIN Tags ON PostTags.TagId = Tags.Id WHERE Posts.PostTypeId = 1 AND Tags.TagName = 'firebase' AND Users.Reputation < 2000) GROUP BY Users.Id HAVING COUNT(Posts.Id) >= 10 AND AVG(Posts.Score) >= 1 ORDER BY AvgScore DESC, VarScore DESC