Stiles's reactions are in part related to deleted dialog from the episode (see this article on Orion Press for the full details
INSERT - SHIP'S VIEWING SCREEN
The attacking vessel can now be seen definitely to be some modified version of a starship saucer main section...........
You see it, Enterprise?! Starship
design. Warn Earth...
... espionage, stolen our designs... traitors...
Then later, before the reveal of the Romulans, Kirk and Stiles' exchange in the script is:
... and in a vessel remarkably similar
. The Outpost Commander
Add to that
the fact it was a sneak attack...
Are you questioning my orders,
Negative, sir. I'm pointing out that
we don't even know what the
Romulans look like, maybe just like
We could have Romulans aboard
our own ship.
So, by the time they SEE the Romulans, Stiles has already had suspicions of Romulan spies, and lo and behold, Spock looks just like one.