I used to work loss prevention/security, and let me tell you at least for the company I worked for, preventing a lawsuit was by far their second most important thought when deciding "what to do" (safety came first). For us, when in doubt (for an issue like this), observe and see what progresses. If it looked to be possible criminal activity that was theft-irrelevant, we'd either call law enforcement and let them do what they felt was necessary or make our presence known to the person in an attempt to deter. Regardless, we were not permitted to accuse of anything.