I suggest changing the flagging system for players looting other players to a two (2) timer system, lets call them the "witness" and "victim" timers.
Witness - The looter is flagged for (t) minutes and that flag is only applies to players that have a direct line of sight to the looting. Alternatively, if that is too complicated, perhaps in a (x) area around the location of the crime.
Victim - The looter is flagged for (T) minutes for the victim only. It is a longer timer to reflect the victim recognising their gear. It also provides them some time to a) return to the scene of the crime and b) try and track down the perp.
An example to these times might be...
- t = 5 minutes
- T = 20 minutes